7 ms·
IMO this is dangerously harmful advice. Even if you do the Full SSL (Strict) version, you are trusting CloudFlare with all data. It's probably fine if you are j
by 0942v8653 8y ago
IMO this is dangerously harmful advice. Even if you do the Full SSL (Strict) version, you are trusting CloudFlare with all data. It's probably fine if you are just doing a static site or something, but the fact that CloudFlare has access to users' passwords gives me the creeps.
(You are also trusting CloudFlare to generate the private key of your web server, which is no big deal if you are already using their services between you and the user, but might be more complicated if you decide to trust that cert for internal use.)
Ultimately I only recommend this if you want a fast fix to prevent public wifi operators from injecting stuff into your HTTP content. Any other use and you'll not be able to sleep at night wondering what kind of data CloudFlare has stored.
- nsgi 8y agoUltimately Cloudflare is just another provider you have to trust if you decide to rely on them, just like your web host and anything else you use. For any non-trivial site you should do a risk assessment of the service providers, external javascript and other software you are using to determine whether the benefits outweigh the risks, and for the most sensitive use cases they should be kept to an absolute minimum. As you say, for a static site HTTPS terminated by Cloudflare is more secure than plain HTTP so it makes the most sense in that situation.
- 0942v8653 8y agoHmm I guess you are right, I was just thinking of the simple case (run on your own metal, no external JS, etc...). I am just uncomfortable with the amount of data that passes through Cloudflare and especially the idea of depending on them just to gain HTTPS support (which you could do almost as easily in other ways). Cloudflare as proxy seems at odds with a decentralized view of the web.