Hot answers tagged

86

There are a number of strategies, each having their own costs and benefits. Here are a few (there are more, and variations): blackholing By blackholing traffic, you discard all traffic towards the target IP address. Typically, ISP's try to use RTBH (remotely triggered blackholing), by which they can ask their upstream networks to discard the traffic, so it ...


23

CloudFlare serves as a guard between your webserver and the client. Every content the client receives got provided by your webserver and filtered by CloudFlare. This way, CloudFlare obfuscates email addresses by filtering them using a regex before delivering it to the client. If your website contains the email <a href="mailto:s@scha.bz">s@scha.bz</...


16

Simple bot behaviour and "normal user" behaviour are noticeable different, and most bots tend to be relatively simple, since it works for the majority of sites. For example, consider arriving on Security.SE: A human loads the page, there is a delay of a few seconds upwards whilst they read the first few questions, then you get a request for a page, followed ...


15

Simply put, the webmaster of the site uploads the certificate to CloudFlare. See this article for details. The Keyless mode doesn't have this requirement. It uses an on premise key server instead, to provide the private key of the server. See the diagram here for details on how this works. For free accounts Cloudflare state in their blog: For all ...


12

In addition to James' and Matthew's answer (which are both valid points by the way): Obviously services like CloudFlare have a bunch of detection methods to decide whether or not a client is allowed through their various layers of protection. They have a lot of information on their website about these features but you probably won't find specific rules ...


7

The security measures you are thinking of already exist. Take a look at this example from jQuery's CDN page: <script src="http://code.jquery.com/jquery-3.3.1.min.js" integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8=" crossorigin="anonymous"></script> The notable part is the integrity="sha256-...", which a browser should check ...


5

But should a CDN service like Cloudflare protect against Brute Force Attacks... TL;DR: Not should but could - but in case of Cloudflare there is actually such functionality. A CDN is a content delivery network and not a content protection network. Some protection against DDoS is an added value Cloudflare and other CDN offer. But this is not core CDN ...


3

Cost Everything you load from someone else is one less thing you need to host yourself. The literal cost (and risk of downtime) of hosting may be small, if you're already hosting your own HTML etc, but we should also count as a complexity cost just having those files in your repositories or on your severs where developers are working. Speed This one is ...


3

If you were reading about how CDNs work, then you will know that the CDN serves copies of the assets on the source site. Just like the article you linked talked about. Hacking the CDN does not mean that they have access to the backend of the source site to log in or place shells. The attackers can, as the article describes, serve whatever content they ...


2

One of the ways you use cloudflare is by setting the NS records for your domain to cloudflare's name servers which in turn resolve www.mydomain.com to their IP addresses. This means that when you go to www.mydomain.com setup with cloudflare, it hits one of their servers. The SSL certificate for that domain is not yours, it's theirs. Check the SSL certificate ...


2

A CDN is supposed to allow sites to reference a remote, publicly available resource (e.g. a script, stylesheet, font, etc), rather than embedding it themselves, and allow the browser to cache it. If the CDN is compromised, then so is the resource. For instance, let's say that the CDN for Bootstrap is compromised and somebody replaces it with a malign ...


2

Provider's Responsibility In the cloud, as a general rule, the cloud provider handles OSI layer 1 and 2 protection. This is essentially free, as they cannot offer a functional service without it. At OSI layers 5+, it's generally up to you unless you're buying SaaS or PaaS. If you're buying SaaS/PaaS, it's likely the responsibility of your provider, ...


1

First - as you wrote the third-party authorization server requires client secret known only to The first-party API - so only your back-end can actually exchange authorization code for access token - nothing wrong here. Second - you should be using HTTPS for your redirection endpoint so make sure your CDN support it. Otherwise somebody can eavesdrop the ...


1

While this won't protect from particularly heavy DoS attacks, you can use a VPS service that provides protection against such attacks as part of the regular package. OVH is one such company that provides attack mitigation to all their VPSes. You can either host your site on their servers directly, or run a GRE tunnel through it, giving you the DoS-resistance ...


1

There are a number of different ways you can configure cloudflare: You can set cloudflare as your DNS provider, most CA considers proof of DNS control as valid proof of domain control. This allows cloudflare to create a valid DV certificate with your domain name. You can give cloudflare your private key, this allows you to use OV or EV certificate. In ...


1

Good question! Let's talk from the context of a practical scenario of a web application deployed into production and it gets attacked by an adversary with 10,000 requests per second at the application-layer coupled by a huge network-layered attack which is still manageable. Certainly, ISPs can handle a DDoS attack but again depends on their overall setup ...


1

CloudFlare nowadays has its own CA so they can fabricate any certificate they want. Their policy is to create certificates for only domains that are hosted on their DNS server but there are no and cannot be such technical limitations. Correction: CloudFlare is running Origin CA but they are not a public CA. The "Origin CA" allows CloudFlare to sign and ...


1

Exactly! You point your DNS to CloudFlare. But it doesn't let you to use your own SSL-certificate if you don't have the Business ($200/month) or Enterprise ($5000/month) plan. You can use a flexible SSL-certificate that they provide. So if you want to use your own EV-SSL-certificate, you need does plans. I do recommend using Incapsula Enterprise instead. ...


Only top voted, non community-wiki answers of a minimum length are eligible