{"action":"created","issue":{"url":"https://api.github.com/repos/sibiantony/ssleuth/issues/76","repository_url":"https://api.github.com/repos/sibiantony/ssleuth","labels_url":"https://api.github.com/repos/sibiantony/ssleuth/issues/76/labels{/name}","comments_url":"https://api.github.com/repos/sibiantony/ssleuth/issues/76/comments","events_url":"https://api.github.com/repos/sibiantony/ssleuth/issues/76/events","html_url":"https://github.com/sibiantony/ssleuth/issues/76","id":185732555,"number":76,"title":"Lower score when Cloudflare certificate is used","user":{"login":"rugk","id":11966684,"avatar_url":"https://avatars.githubusercontent.com/u/11966684?v=3","gravatar_id":"","url":"https://api.github.com/users/rugk","html_url":"https://github.com/rugk","followers_url":"https://api.github.com/users/rugk/followers","following_url":"https://api.github.com/users/rugk/following{/other_user}","gists_url":"https://api.github.com/users/rugk/gists{/gist_id}","starred_url":"https://api.github.com/users/rugk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rugk/subscriptions","organizations_url":"https://api.github.com/users/rugk/orgs","repos_url":"https://api.github.com/users/rugk/repos","events_url":"https://api.github.com/users/rugk/events{/privacy}","received_events_url":"https://api.github.com/users/rugk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-10-27T17:30:20Z","updated_at":"2016-10-27T22:00:56Z","closed_at":null,"body":"First read:\r\n* https://scotthelme.co.uk/cloudflares-great-new-features-and-why-i-wont-use-them/\r\n* Practical example: https://medium.com/@karthikb351/airtel-is-sniffing-and-censoring-cloudflares-traffic-in-india-and-they-don-t-even-know-it-90935f7f6d98#.hz4zd6hv6\r\n\r\nSo as you see in the default setting the TLS connection ends at Cloudflare and Cloudflare seriously fetches unverified & unencrypted content over HTTP and makes it available over HTTPS.\r\nOf course web admins can slightly (or even better not so slightly) improve security by enabling other modes and deploy a cert on their own server, but personally I doubt many people do this. Most might just think: \"Hey, all right. We now use HTTPS, so this is secure.\"\r\n\r\nUnfortunately AFAIK Cloudflare still provides no method to get out what SSL/TLS mode is used.\r\nAnyway I'd suggest you lower the score and/or - at least - show a warning, so users are made aware of this.\r\nIt's easy to detect Cloudflare certificates as they are issued for (CN) \"[...].cloudflaressl.com\".\r\n"},"comment":{"url":"https://api.github.com/repos/sibiantony/ssleuth/issues/comments/256782515","html_url":"https://github.com/sibiantony/ssleuth/issues/76#issuecomment-256782515","issue_url":"https://api.github.com/repos/sibiantony/ssleuth/issues/76","id":256782515,"user":{"login":"jeifour","id":3247063,"avatar_url":"https://avatars.githubusercontent.com/u/3247063?v=3","gravatar_id":"","url":"https://api.github.com/users/jeifour","html_url":"https://github.com/jeifour","followers_url":"https://api.github.com/users/jeifour/followers","following_url":"https://api.github.com/users/jeifour/following{/other_user}","gists_url":"https://api.github.com/users/jeifour/gists{/gist_id}","starred_url":"https://api.github.com/users/jeifour/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeifour/subscriptions","organizations_url":"https://api.github.com/users/jeifour/orgs","repos_url":"https://api.github.com/users/jeifour/repos","events_url":"https://api.github.com/users/jeifour/events{/privacy}","received_events_url":"https://api.github.com/users/jeifour/received_events","type":"User","site_admin":false},"created_at":"2016-10-27T22:00:56Z","updated_at":"2016-10-27T22:00:56Z","body":"TLS does not mean that your data is safe. It means that your connection to a certain server is safe, and that the data you send over that one connection therefore won't get out to a third party by doing so, but what happens to it after you sent it is out of your hands. So I don't think this is an issue SSleuth should be concerned with. (Not saying this isn't a more general problem, of course.)\r\n\r\nWhat makes you distrust a connection to a Cloudflare server, but trust all the other TLS connections to other servers? Alright, maybe you're very sure that your bank knows how to security is done right, and you're also sure websites like Github know how to secure their customer data because they certainly employ technically skilled people, and that, I'd reckon, is also probably the truth, but then the only thing maybe useful would be a Whitelist for trusted parties, and not a Blacklist with a single entry titled \"Cloudflare\". (And then there are some websites using Cloudflare that might even have a secure configuration after all, so the warning wouldn't be appropriate then.)\r\n\r\nIf most people think \"Hey, all right. We now use HTTPS, so this is secure.\", then that in itself is the problem. With Cloudflare just being a good example of why, not a singular instance of failure. I don't doubt they indeed think like this, but lowering the score for Cloudflare is not the correct way of handling that problem in my opinion. If anything, maybe educating users should look something like: \"TLS only secures your browser's connection to web servers, it isn't a guarantee for secure and/or lawful handling of inputted data.\" (I'm not a native speaker so the phrasing is probably off, but I hope you get my drift.)\r\n\r\nSide note: Interesting articles, thanks for linking them. I actually have thought about this problem a few times before but didn't follow up on any news about it."}}
{"actor":{"display_login":"jeifour"}}