Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueCoat and other proxies hang up during TLS 1.3

bugs.chromium.org

Post reply on HN
Print view View original

21–30 of 216 posts

Re: BlueCoat and other proxies hang up during TLS 1.3

#21

Post by discreditable »

Viper007Bond wrote: post #11
db48x wrote: post #10

The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.

Isn't MITM required in enterprise environments where they want to filter content? Unless you want to run it client-side which isn't usually an option.

Basic filtering can be done via passively inspecting SNI headers and terminating connections to verboten hosts. However, that's not enough for some orgs, and some software works around it: https://www.bamsoftware.com/papers/fronting/

Re: BlueCoat and other proxies hang up during TLS 1.3

#22

Post by wildmusings »

db48x wrote: post #10

The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective.

If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer to know what you're doing, then don't use the company computer or company network to do it. And while you may think that you're too tech savvy to fall prey to malware 1) not everyone at your company is, and 2) no amount of savvy will protect you from all malware, especially ones that gain a foothold through an unpatched exploit. And there's also that whole other can of worms: malicious employees.

Re: BlueCoat and other proxies hang up during TLS 1.3

#23

Post by theluketaylor »

emmab wrote: post #14
Viper007Bond wrote: post #11

Earlier quoted context omitted.

Isn't MITM required in enterprise environments where they want to filter content? Unless you want to run it client-side which isn't usually an option.

> Isn't MITM required in enterprise environments where they want to filter content? Then don't filter content.

At my workplace we need to use middleboxes like this for 2 reasons

-our commitment to our customers and regulatory compliance requires we know where customer data is at all times. It would be lovely if all employees could be trusted with data at all times, but the reality is some employees will steal information, as google found out with Levandowski. That's google's own information though; they don't have a regulatory requirement to report the breach, whereas the data I protect requires full disclosure legally.

-malware is increasingly using https to communicate with C&C. Many malware families now install a trusted root cert so they can exfiltrate data on less monitored 443 rather than 80. When (not if) devices get compromised we need to know what the attacker got.

I would love to not need to do this because it's a privacy mess and breaks applications all the time, but there simply are not better tools to serve as the last line of defence against data loss.

iOS has mostly solved this problem through a combination of not running unsigned code and APIs where MDM can draw a corporate data barrier inside the phone, but while desktop OSs remain there will need to be some form of this.

Re: BlueCoat and other proxies hang up during TLS 1.3

#24

Post by hermitdev »

johncolanduoni wrote: post #19
db48x wrote: post #10

The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.

This is legally required in some sectors for regulation purposes, notably finance. I think a lot of people who casually throw out this sentiment don't appreciate that aspect of it.

+1. I work in regulatory compliance at a financial firm. My current firm doesn't do this because we don't originate trades, but when I worked at a hedge fund, all forms of electronic communications were MITM'd & recorded for regulatory reasons (and to monitor for IP theft - we did sue a soon former employee after he emailed source for a quantitative model to his personal gmail) primarily to combat or defend against insider trading.

Re: BlueCoat and other proxies hang up during TLS 1.3

#25

Post by x1798DE »

stonogo wrote: post #17
db48x wrote: post #10

The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.

I'm sure the students of the Montgomery County, Maryland public school system, who are affected by this problem, will take your advice into consideration when submitting resumes to other public schools.

They should lobby the school board not to do this nonsense.

Re: BlueCoat and other proxies hang up during TLS 1.3

#26

Post by DannyBee »

emmab wrote: post #14
Viper007Bond wrote: post #11

Earlier quoted context omitted.

Isn't MITM required in enterprise environments where they want to filter content? Unless you want to run it client-side which isn't usually an option.

> Isn't MITM required in enterprise environments where they want to filter content? Then don't filter content.

Great, as long as the world is black and white and completely susceptible to binarization.

Re: BlueCoat and other proxies hang up during TLS 1.3

#27

Post by 234dd57d2c8dba »

coderobe wrote: post #3
JoshTriplett wrote: post #2

Note that this happens even when using a BlueCoat proxy in non-MITM mode. BlueCoat tries to "analyze" TLS connections, and rejects anything it doesn't understand. This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0. In this case, it doesn't sound like they're reverting it because of overall breakage, but rather because it breaks the tool that would otherwise be used to control TLS 1.3 tr…

Rejecting anything it doesn't understand sounds like a bug to me. If it sees that it's TLS, it should attempt a protocol downgrade. There's absolutely no reason for this to break, as TLS 1.3 exists alongside TLS 1.2 (For now).

It's a security feature, often malware will send encrypted traffic over 443 in an attempt to bypass firewalls. If BlueCoat can't understand the traffic, it drops it as it assumes it's malicious.

Re: BlueCoat and other proxies hang up during TLS 1.3

#28

Post by acdha »

x1798DE wrote: post #25
stonogo wrote: post #17

Earlier quoted context omitted.

I'm sure the students of the Montgomery County, Maryland public school system, who are affected by this problem, will take your advice into consideration when submitting resumes to other public schools.

They should lobby the school board not to do this nonsense.

Think about how that conversation would go. They're driven by concerns that kids will look at porn – and remember that if they don't try to stop that, the local Fox News applicate will be running a loop 24x7 saying they're trying to force godly children to watch it – or that someone will breach a staff member's computer and steal PII, compromise the security cameras, etc.

Against that, making life hard for Chrome engineers’ aggressive upgrade campaign is pretty hard sell. “Buy a better box” perhaps but I don't see a viable argument for “don't monitor”.

Re: BlueCoat and other proxies hang up during TLS 1.3

#29

Post by _jal »

parennoob wrote: post #15
Viper007Bond wrote: post #11

Earlier quoted context omitted.

Isn't MITM required in enterprise environments where they want to filter content? Unless you want to run it client-side which isn't usually an option.

There are ways to filter content without breaking user privacy. For example, you could restrict access to the Internet altogether, and suggest that your users only get what they need from your internal corporate network. See how incredibly productive that makes your staff? What these "enterprise environments" want is to leech off the Internet's knowledge while keeping a firm chokehold on the privacy of their own empl…

> What these "enterprise environments" want is to leech off the Internet's knowledge while keeping a firm chokehold on the privacy of their own employees

Because one size really does fit all, and all environments have the same needs?

Re: BlueCoat and other proxies hang up during TLS 1.3

#30

Post by bgc »

x1798DE wrote: post #25
stonogo wrote: post #17

Earlier quoted context omitted.

I'm sure the students of the Montgomery County, Maryland public school system, who are affected by this problem, will take your advice into consideration when submitting resumes to other public schools.

They should lobby the school board not to do this nonsense.

The Board doesn't have a choice, under CIPA[0], content filtering is a requirement for the FCC's E-Rate program[1] in which the government pays some of the cost of the school's internet connection.

[0]https://www.fcc.gov/consumers/guides/childrens-internet-prot...

[1]https://www.fcc.gov/general/universal-service-program-school...

Post reply on HN