February 2015 Summaries

The text discusses securing connections between Cloudflare and origin servers, as well as end users and Cloudflare. It introduces TLS Client Authentication, which allows both client and server to verify each other's identity during a handshake. This feature is implemented in nginx by one of Cloudflare's engineers, Piotr Sikora, and the code is open source. The text also explains how to enable Authenticated Origin Pulls using Cloudflare's new dashboard (currently in beta). Additionally, it provides a certificate signed by a CA for use with this feature. Finally, configuration examples for popular web servers will be included in Cloudflare Support Docs soon.

The US Federal Communications Commission (FCC) has voted to extend rules regulating telephone industry to now cover Internet Service Providers (ISPs), in an effort to preserve network neutrality, which prevents networks from discriminating against content that passes through them. While the author of this text is a proponent of network neutrality and celebrates the FCC's decision, he also expresses concerns about potential negative consequences. He worries that the shift from bottom-up governance by technologists to top-down regulation by lawyers may lead to less neutral networks in the future. The author suggests that instead of setting strict rules, the FCC should establish standards and closely monitor ISPs' compliance with them.

HTTP Strict Transport Security (HSTS) is a security policy technology designed to protect against downgrade attacks on HTTPS web servers. Despite being powerful, HSTS has not been widely adopted. CloudFlare aims to change this by making it easy for users to configure the technology on their domains. Downgrade attacks, also known as SSL stripping attacks, are a form of on-path attacker attack where an attacker redirects web browsers from a secure HTTPS server to an attacker-controlled server, compromising user data. HSTS headers consist of several parameters, including a configurable duration for client web browsers to cache and enforce policy. The technology causes compliant browsers to strictly enforce web security practices by automatically turning all HTTP links into HTTPS links within an application and upgrading SSL errors from warnings or bypassable errors into non-bypassable errors. CloudFlare's default SSL settings are compatible with HSTS, making it a suitable platform for enabling the technology on domains.

At Cloudflare, the goal is to make websites faster and safer at scale. To achieve this, they introduced "Universal SSL" which required efficient handling of large volumes of HTTPS traffic. They used two standardized session resumption mechanisms - Session IDs RFC 5246 and Session Tickets RFC 5077. For session ID resumption, Cloudflare shares sessions within the Point of Presence (PoP) using a memcached cluster to cache all recent negotiated sessions from all hosts within the same PoP. This approach enhances the secrecy and security of session keys by encrypting all cached sessions. For session ticket resumption, they designed an in-memory key generator daemon that generates fresh, timestamped keys every hour, which are then distributed to all hosts across the globe securely without being written to disk. These measures have made HTTPS performance faster for every user and device on Cloudflare's network.

CloudFlare has introduced a new Origin CA service, providing free limited-function certificates for customer origin servers. This public beta aims to provide full encryption of all data from the browser to the origin server at no cost. The service offers three modes for HTTPS: Flexible, Full and Strict. Sites on CloudFlare's Free plan default to Flexible SSL mode, but customers can now get a free certificate directly from CloudFlare for their Strict SSL mode. To sign up for the beta, send an email with a Certificate Signing Request (CSR), domain name and zone information. The Origin CA is not currently trusted by browsers, so these certificates should only be used on sites that are behind CloudFlare.

On February 23, 2015, Cloudflare disabled the RC4 encryption algorithm for all SSL/TLS connections to its sites due to security concerns. The company had previously deprecated RC4 in May 2014 and noted that some users still required it, particularly those using old mobile phones and Windows XP. However, recent data showed a significant decline in RC4 usage, with almost all remaining requests coming from old phones and Windows XP users. Additionally, some connections were traced back to SSL-intercepting proxy software using RC4. Cloudflare decided to disable the protocol completely due to its lack of security and the availability of more secure alternatives.

CloudFlare has announced the start of SSL Week, during which they plan to make several announcements aimed at improving encryption on the internet. They aim for encryption to be easy and inexpensive to use, fast without affecting performance, and up-to-date with the latest vulnerabilities. One initiative is making it easy and free to ensure secure connections from CloudFlare back to the origin server. Additionally, they will add support for a new cipher while deprecating an older one that has become compromised. Further announcements are expected throughout SSL Week.

CloudFlare has introduced a new feature that improves mobile performance by adding support for the ChaCha20-Poly1305 cipher suites, making it the first major site to do so apart from Google services. This enhances security and speeds up mobile browsing experience on sites using CloudFlare. The protocol used for encrypting HTTPS connections is Transport Layer Security (TLS), which allows new encryption algorithms or ciphers to be proposed and added to its specification. The new cipher suites use the ChaCha20 stream cipher, designed to provide 256-bit security, and Poly1305 authenticator for authentication. These are considered more secure than standard choices and provide a battery-friendly alternative to AES for mobile devices.

CloudFlare has partnered with Parallels to launch ServerShield, an extension that combines the performance and security features of CloudFlare with StopTheHacker's malware scanning and removal solution. The tool is now available for all Plesk 12 users. It helps protect against DDoS attacks and malware infections by stopping threats at the edge before they reach a site, providing a dashboard to show customers how many threats have been prevented, and triggering an automatic malware clean-up of infected accounts. ServerShield is pre-installed on all Plesk12 servers and available in multiple languages.

CloudFlare, one of the largest third-party DNS Authoritative operators globally, manages over 1 million domains and has registrations in almost every TLD open for registration. The company is advocating for an automated process to change NS records, which would help solve operational difficulties faced by DNS service providers and pave the way for DNSSEC implementation. Currently, manual updates are required, causing inconvenience to customers and hindering the ability of DNS operators to quickly respond to issues such as DDoS attacks or maintain DS records for DNSSEC. CloudFlare is calling on Registrars, Registries, and other DNS Operators to join them in defining and deploying more reliable methods for updating NS and DS records, which would benefit customers and the internet as a whole.

Last week, a few users experienced issues accessing Cloudflare services due to a broken "path MTU discovery" on the company's servers. This issue affected those using IP tunnels, primarily for IPv6 over IPv4. The problem was caused by a networking change that impacted path MTU discovery. To fix this, Cloudflare implemented a comprehensive solution called Path MTU Daemon (PMTUD), which is now open-source and available on GitHub. Additionally, the company enabled RFC4821 Path MTU Discovery for IPv4 to help with true ICMP black holes.