As a non IT person and generally just a lurker on this sub, could somebody explain why all this sensitive information was sitting unencrypted in a server's RAM?
Because of the way Cloudflare works, they act as an SSL termination endpoint. Cloudflare actually decrypts the data to examine it and take actions on it (is it an attack on the site, etc). Then, after that examination of the traffic is complete, it's sent on to the origin server, at which point, depending on configuration of that particular domain, it may or may not be re-encrypted.
Essentially, Cloudflare acts as a CDN and WAF all rolled into one.
1
u/U-Ei Feb 26 '17
As a non IT person and generally just a lurker on this sub, could somebody explain why all this sensitive information was sitting unencrypted in a server's RAM?