Stream any good movies lately?
Show HN: Using eBPF to see through encryption without a proxy
61–70 of 80 posts
Re: Show HN: Using eBPF to see through encryption without a proxy
#62To everyone building these things: Please add a disclaimer to say something like:
"This is not a vulnerability: eBPF currently requires root access to do this. Also, eBPF makes this easy but does not make it possible, as debuggers, interposers/shims, and other tools can also attach to pre-encryption points, and therefore banning eBPF (as some people want to do after seeing projects like this) would not actually improve security, but it would instead _reduce_ security as it would prevent eBPF-based security solutions from being used."
Re: Show HN: Using eBPF to see through encryption without a proxy
#63To everyone building these things: Please add a disclaimer to say something like: "This is not a vulnerability: eBPF currently requires root access to do this. Also, eBPF makes this easy but does not make it possible, as debuggers, interposers/shims, and other tools can also attach to pre-encryption points, and therefore banning eBPF (as some people want to do after seeing projects like this) would not actually impro…
Great idea!
On an unrelated note, your work has inspired most of my career in Solaris/Illumos/Linux systems and honestly this project likely wouldn't have happened if it wasn't for all of your books/blogs/projects to help me along the way. Thank you!
Re: Show HN: Using eBPF to see through encryption without a proxy
#64I like the fact this doesn't impact performance like MITM solutions do.
That was one of our biggest motivators when dreaming up Qtap. How can we remove the impact that proxies have on connections, AND see the content without having to manage a custom certificate authority, AND not have to instrument all of our code.
If installed in a router, can it see traffic of all devices connected to it or only traffic that originates in the router itself?
Perhaps with `direction: all`
https://github.com/qpoint-io/qtap/issues/29#issuecomment-286...
Re: Show HN: Using eBPF to see through encryption without a proxy
#65Do you support Java? If so, how do you do this for Java?
Re: Show HN: Using eBPF to see through encryption without a proxy
#66I know that arguing that SSLKEYLOGFILE is all you need will just be a different version of the rsync/dropbox comment, but I do wonder under what circumstances is one able to strace a binary and isn’t able to make it dump session keys? I read the headline and set high hopes on finding a nifty way to mitm apps on Android - alas, I’m not sure this would work there necessarily.
My big use case is watching on the SERVER side, my coworkers will be asking me to help them debug something and I just want to see the HTTP plaintext, I don't really want to try running Apache under SSLKEYLOGFILE or something, I just want to see the data. ;-)
Re: Show HN: Using eBPF to see through encryption without a proxy
#67Do you support Java? If so, how do you do this for Java?
Java is supported, but currently in the pro version. Since JavaSSL is implemented in Java code, which runs in the Java VM and not exported as static symbols that can be uprobe'd, there is a bit more involved to generate a bridge between the JVM bytecode and static symbols that can be probed.
Re: Show HN: Using eBPF to see through encryption without a proxy
#68There's a similiar tool https://github.com/gojue/ecapture
Grafana's Beyla also basically works the same way https://github.com/grafana/beyla
Re: Show HN: Using eBPF to see through encryption without a proxy
#69With the minimal perf impact, does that mean it is not 100% guaranteed to catch all traffic? I’d think you’d have to insert yourself synchronously into the comms or allow some to get past unseen (eg when systems are heavily loaded).
Re: Show HN: Using eBPF to see through encryption without a proxy
#70I'm a heavy forward proxy user. Whatever the performance hit, I don't notice it. I do notice the performance hit of HTTPS versus HTTP.
Modifying response bodies in the forward proxy is less than ideal. The proxy must wait for the full response body to be received before making modifications.
Can eBPF be any better in this regard.