ETS Isn't TLS and You Shouldn't Use It
1–10 of 112 posts
Re: ETS Isn't TLS and You Shouldn't Use It
#2So what's the argument from the other side? Going through all this effort to allow PFS to be disabled seems like a ton of work? What's their use-case?
Re: ETS Isn't TLS and You Shouldn't Use It
#3This is a remarkable story. Fortunately, this ETSI-backed "ETS" standard appears to have just about zero uptake or internet presence, let alone vendor acceptance. So although this is fairly outrageous based on the EFF article, it doesn't look like something that's a big threat to TLS at this point.
PS. I can't even get ETSI's website to load! https://www.etsi.org/
Re: ETS Isn't TLS and You Shouldn't Use It
#4So what's the argument from the other side? Going through all this effort to allow PFS to be disabled seems like a ton of work? What's their use-case?
Banks are required by regulation to monitor & audit pretty much everything. Previously they did this for internet usage by using MITM proxies. TLS 1.3 makes that approach hard/impossible.
Re: ETS Isn't TLS and You Shouldn't Use It
#5So what's the argument from the other side? Going through all this effort to allow PFS to be disabled seems like a ton of work? What's their use-case?
There's a whole IT market segment around TLS decryption for corporate LAN. Basically corporate MITM that will decrypt TLS at the gateway / firewall, and with currently used TLS standards, will then re encrypt the traffic back to the client so the browser thinks it has a legit connection. It's used to scan packets for intrusion detection, for malware, to track for data loss like the article talks about.
Re: ETS Isn't TLS and You Shouldn't Use It
#6So what's the argument from the other side? Going through all this effort to allow PFS to be disabled seems like a ton of work? What's their use-case?
Breaking the security of HTTPS for surveillance and monitoring purposes. The BITS group is formally opposed to secure communications because they want to make it easier to MITM attack the secure communication. They want to make it easier to decrypt communication.
Re: ETS Isn't TLS and You Shouldn't Use It
#7So what's the argument from the other side? Going through all this effort to allow PFS to be disabled seems like a ton of work? What's their use-case?
Banks are required by regulation to monitor & audit pretty much everything. Previously they did this for internet usage by using MITM proxies. TLS 1.3 makes that approach hard/impossible.
Why can't they just install their own self signed root ca on all their computers and continue MITM it?
Re: ETS Isn't TLS and You Shouldn't Use It
#8Earlier quoted context omitted.
Banks are required by regulation to monitor & audit pretty much everything. Previously they did this for internet usage by using MITM proxies. TLS 1.3 makes that approach hard/impossible.
Why can't they just install their own self signed root ca on all their computers and continue MITM it?
Certificate pinning is used by some very common applications and can break a MITM that relies on a self-signed certificate.
Re: ETS Isn't TLS and You Shouldn't Use It
#9So what's the argument from the other side? Going through all this effort to allow PFS to be disabled seems like a ton of work? What's their use-case?
There's a whole IT market segment around TLS decryption for corporate LAN. Basically corporate MITM that will decrypt TLS at the gateway / firewall, and with currently used TLS standards, will then re encrypt the traffic back to the client so the browser thinks it has a legit connection. It's used to scan packets for intrusion detection, for malware, to track for data loss like the article talks about.
All of those require your computer to trust a new Certificate Authority or you will get warnings all over the place. If there is a company that claims to be able to do it without trusting the CA or producing warnings I would love to see it. (seriously, I actually would love to see that).
And if you are in a corporate environment using a company computer you forfeit your privacy anyway. You can always go somewhere else or do your banking and Facebook on a different machine / not on company time.
Re: ETS Isn't TLS and You Shouldn't Use It
#10Earlier quoted context omitted.
Why can't they just install their own self signed root ca on all their computers and continue MITM it?
Certificate pinning is used by some very common applications and can break a MITM that relies on a self-signed certificate.
Are those common applications necessary for their business operations though? They could just blacklist them entirely.