Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deep packet inspection is dead, and here's why (2017)

security.ias.edu

Post reply on HN
Print view View original

11–20 of 126 posts

Re: Deep packet inspection is dead, and here's why (2017)

#11

Post by dstjean »

jopsen wrote: post #10
dstjean wrote: post #9

Earlier quoted context omitted.

In a corporate environment, managed devices can be configured to force the use of specific DNS settings. The same type of implementation (MITM) could be used to analyse the requests. That being said, this is at the OS level. An app such as Firefox could still override those settings or provide their own implementation.

If you IT department is your adversary you should get a new job. Or at least use a personal device for personal matters :)

I don't think NOT performing packet inspection due to privacy concern is a good idea. (Good security controls should exist over its administration)

One reason why organizations use packet inspection is to protect its staffs, customers and vendors from malicious actors who could cause data breaches leading to huge privacy issues.

Privacy over Security? The right balance must be found

Re: Deep packet inspection is dead, and here's why (2017)

#12

Post by hunter2_ »

yholio wrote: post #3

Breaking TLS so you can do deep packet inspection is like a lifeguard throwing people in the water during winter so he can save them.

Or a lifeguard blowing their whistle at folks who specifically used the "no lifeguard on duty" beach so they could swim out far.

Re: Deep packet inspection is dead, and here's why (2017)

#13

Post by LeifCarrotson »

dstjean wrote: post #11
jopsen wrote: post #10

Earlier quoted context omitted.

If you IT department is your adversary you should get a new job. Or at least use a personal device for personal matters :)

I don't think NOT performing packet inspection due to privacy concern is a good idea. (Good security controls should exist over its administration) One reason why organizations use packet inspection is to protect its staffs, customers and vendors from malicious actors who could cause data breaches leading to huge privacy issues. Privacy over Security? The right balance must be found

A user has no way of knowing whether a packet inspection will be performed by benevolent actors seeking to protect their security or by malicious actors seeking to invade their privacy.

As in the good old post "What colour are your bits" [1] regarding the subject of copyright, the computer is colorblind when it comes to privacy vs. security tradeoffs. You seem to see color, believing compromise for security to be acceptable, and hoping you can allow your lawful and good security inspections to occur while disallowing nasty privacy invasion.

The computer doesn't see color. It is impossible to build a security protocol that will distinguish between good third parties and malicious third parties. "Good security controls" come down to trusting people to do the right thing, and when there's big money coercing companies to do the wrong thing, the right thing too often loses.

[1]: https://ansuz.sooke.bc.ca/entry/23/

Re: Deep packet inspection is dead, and here's why (2017)

#14

Post by bawana »

I did not realize that squid could provide false certificates on the fly. The whole business of invalid certificates made people nervous about some sites. Now someone can sit in starbucks with a squid proxy in the middle and harvest everything, regardless of ssl encryption. Looking at the little lock in the URL means nothing to a MITM running squid. Will a VPN protect me by encrypting everything from my machine so that a squid in the middle will be thwarted?

Re: Deep packet inspection is dead, and here's why (2017)

#15

Post by nickthemagicman »

bawana wrote: post #14

I did not realize that squid could provide false certificates on the fly. The whole business of invalid certificates made people nervous about some sites. Now someone can sit in starbucks with a squid proxy in the middle and harvest everything, regardless of ssl encryption. Looking at the little lock in the URL means nothing to a MITM running squid. Will a VPN protect me by encrypting everything from my machine so th…

The whole point of certificates is for the browser to check with a cert authority. How does squid circumvent the certificate authority?

I think VPN may not be safe if the local machine has to negotiate encryption with the VPN server. Squid seems like it couldn't intercelt that.

Re: Deep packet inspection is dead, and here's why (2017)

#16

Post by detaro »

nickthemagicman wrote: post #15
bawana wrote: post #14

I did not realize that squid could provide false certificates on the fly. The whole business of invalid certificates made people nervous about some sites. Now someone can sit in starbucks with a squid proxy in the middle and harvest everything, regardless of ssl encryption. Looking at the little lock in the URL means nothing to a MITM running squid. Will a VPN protect me by encrypting everything from my machine so th…

The whole point of certificates is for the browser to check with a cert authority. How does squid circumvent the certificate authority? I think VPN may not be safe if the local machine has to negotiate encryption with the VPN server. Squid seems like it couldn't intercelt that.

It doesn't. In enterprise environments that use something like this, the sysadmins install their own CA certificate on all machines. You can't just MITM random machines at a coffeeshop.

Re: Deep packet inspection is dead, and here's why (2017)

#17

Post by Tepix »

bawana wrote: post #14

I did not realize that squid could provide false certificates on the fly. The whole business of invalid certificates made people nervous about some sites. Now someone can sit in starbucks with a squid proxy in the middle and harvest everything, regardless of ssl encryption. Looking at the little lock in the URL means nothing to a MITM running squid. Will a VPN protect me by encrypting everything from my machine so th…

Your machine (browser) will only accept the false certificates without complaining a lot if you have previously added the certification authority of the attacker to your browsers list of valid CAs.

Re: Deep packet inspection is dead, and here's why (2017)

#18

Post by [deleted] »

nickthemagicman wrote: post #15
bawana wrote: post #14

I did not realize that squid could provide false certificates on the fly. The whole business of invalid certificates made people nervous about some sites. Now someone can sit in starbucks with a squid proxy in the middle and harvest everything, regardless of ssl encryption. Looking at the little lock in the URL means nothing to a MITM running squid. Will a VPN protect me by encrypting everything from my machine so th…

The whole point of certificates is for the browser to check with a cert authority. How does squid circumvent the certificate authority? I think VPN may not be safe if the local machine has to negotiate encryption with the VPN server. Squid seems like it couldn't intercelt that.

[deleted]

Re: Deep packet inspection is dead, and here's why (2017)

#19

Post by knome »

bawana wrote: post #14

I did not realize that squid could provide false certificates on the fly. The whole business of invalid certificates made people nervous about some sites. Now someone can sit in starbucks with a squid proxy in the middle and harvest everything, regardless of ssl encryption. Looking at the little lock in the URL means nothing to a MITM running squid. Will a VPN protect me by encrypting everything from my machine so th…

SSL certificates have to be signed by a vendor ( authority ) your browser trusts or the certificates are considered invalid ( hence the hoo-ha when firefox or chrome occasionally stop trusting some vendor for bad practices ).

Your workplace can install themselves as a trusted certificate authority on client machines in order to break that model and allow themselves to issue certificates on the fly for any website.

If you're using your own hardware, they can't do this to you. If you're using someone else's, you're at their mercy.

Re: Deep packet inspection is dead, and here's why (2017)

#20

Post by mabbo »

A few years ago, one of the best managers I ever worked for left to become the CTO of a company doing pattern analysis of network traffic, rather than Deep Packet Inspection. The premise was that most of the internet traffic on your network follows the same typical patterns, but nefarious traffic doesn't. Drop their system into the network and voila, you can start to find the weird things going on that seem out of the ordinary.

At the time, I thought that it seemed a bit heavy-handed- just use DPI and you'll get the same results. This article is making me think he was very prescient in the matter.

Post reply on HN