Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ETS Isn't TLS and You Shouldn't Use It

eff.org

Post reply on HN
Print view View original

51–60 of 112 posts

Re: ETS Isn't TLS and You Shouldn't Use It

#51

Post by cbsmith »

JoshTriplett wrote: post #44
cbsmith wrote: post #42

Earlier quoted context omitted.

...and they want that for transparency, not for nefarious reasons.

MITMing TLS outside the endpoints is inherently nefarious, whether they think it is or not. If you want to compromise the endpoint, compromise the endpoint. Install your own MITM certificates and terminate the connection in the middle, or install client-side malware. Either way, there should always be a giant warning sign on the client that end-to-end security is compromised.

They don't want to compromise the endpoint. They want to ensure they have a record of all communications to and from the endpoint.

Re: ETS Isn't TLS and You Shouldn't Use It

#52

Post by cbsmith »

JoshTriplett wrote: post #44
cbsmith wrote: post #42

Earlier quoted context omitted.

...and they want that for transparency, not for nefarious reasons.

MITMing TLS outside the endpoints is inherently nefarious, whether they think it is or not. If you want to compromise the endpoint, compromise the endpoint. Install your own MITM certificates and terminate the connection in the middle, or install client-side malware. Either way, there should always be a giant warning sign on the client that end-to-end security is compromised.

...and in this context they aren't compromising it. They're just sharing their keys so that another component, all part of the same trusted system, can also decrypt the traffic.

Re: ETS Isn't TLS and You Shouldn't Use It

#53

Post by bitwize »

uniformlyrandom wrote: post #13

Funny how word 'Enterprise' picks up more and more negative connotation in modern software world. These days, 'enterprise' means outdated, inflexible and intentionally flawed monster of technology.

I find a useful definition of "enterprise" is this: products or services whose customers are several levels up the org chart from their users.

Re: ETS Isn't TLS and You Shouldn't Use It

#54

Post by Animats »

We need a big budget cut in the "homeland security" area. All this interception is not paying off. The biggest "terrorist event" in the US since 2001 was the guy who shot up a gay nightclub in Orlando FL in 2017. That was a solo nutcase; there was no planning chatter to intercept. The Boston Marathon bombing was two brothers. The San Bernardino shooting was a husband and wife.

What's discouraging terrorism is the US's overreaction outside the US. It's become very clear to terrorist organizations that if they attack the US, the US is going to hit back, even if it's insanely expensive and causes collateral damage. The people in charge, and many people around them, end up dead.

Remember ISIS, the Islamic State? ISIS is down to 1.5 square miles, surrounded, and everybody but the most fanatical fighters is surrendering. The holdouts have days to live.

We don't need more Big Brother.

Re: ETS Isn't TLS and You Shouldn't Use It

#55

Post by pjmlp »

uniformlyrandom wrote: post #13

Funny how word 'Enterprise' picks up more and more negative connotation in modern software world. These days, 'enterprise' means outdated, inflexible and intentionally flawed monster of technology.

Did it ever meant anything else?

Many that throw jabs at J2EE (written on purpose), never had the joys of trying out xBaseEE, CEE, C++EE (CORBA, DCOM/MTS),...

Re: ETS Isn't TLS and You Shouldn't Use It

#56

Post by influx »

Animats wrote: post #54

We need a big budget cut in the "homeland security" area. All this interception is not paying off. The biggest "terrorist event" in the US since 2001 was the guy who shot up a gay nightclub in Orlando FL in 2017. That was a solo nutcase; there was no planning chatter to intercept. The Boston Marathon bombing was two brothers. The San Bernardino shooting was a husband and wife. What's discouraging terrorism is the US'…

I completely agree with you, but the counter argument is the only incidents that are getting through are the ones that are solo because the more complicated plots are getting intercepted and disrupted.

Re: ETS Isn't TLS and You Shouldn't Use It

#57

Post by 51lver »

influx wrote: post #56
Animats wrote: post #54

We need a big budget cut in the "homeland security" area. All this interception is not paying off. The biggest "terrorist event" in the US since 2001 was the guy who shot up a gay nightclub in Orlando FL in 2017. That was a solo nutcase; there was no planning chatter to intercept. The Boston Marathon bombing was two brothers. The San Bernardino shooting was a husband and wife. What's discouraging terrorism is the US'…

I completely agree with you, but the counter argument is the only incidents that are getting through are the ones that are solo because the more complicated plots are getting intercepted and disrupted.

That's because people have hands and throats, weapons and weaknesses. You simply can't stop a killer operating at an animal level unless it's stopped while in progress. Stopping organized killing beforehand is however quite feasible, and society does have some responsibilities there.

Re: ETS Isn't TLS and You Shouldn't Use It

#58

Post by dreamcompiler »

bitwize wrote: post #53
uniformlyrandom wrote: post #13

Funny how word 'Enterprise' picks up more and more negative connotation in modern software world. These days, 'enterprise' means outdated, inflexible and intentionally flawed monster of technology.

I find a useful definition of "enterprise" is this: products or services whose customers are several levels up the org chart from their users.

It's even simpler than that: Enterprise just means the people paying for the software are not its users. This is why enterprise software always sucks.

Re: ETS Isn't TLS and You Shouldn't Use It

#60

Post by cesarb »

cbsmith wrote: post #52
JoshTriplett wrote: post #44

Earlier quoted context omitted.

MITMing TLS outside the endpoints is inherently nefarious, whether they think it is or not. If you want to compromise the endpoint, compromise the endpoint. Install your own MITM certificates and terminate the connection in the middle, or install client-side malware. Either way, there should always be a giant warning sign on the client that end-to-end security is compromised.

...and in this context they aren't compromising it. They're just sharing their keys so that another component, all part of the same trusted system, can also decrypt the traffic.

Sharing the key allows more than just decryption; it also allows undetectable modification of the traffic. A protocol which allowed third-party decryption but not modification would have been designed differently.
Post reply on HN