Spying on HTTPS
textslashplain.com
Spying on HTTPS
1–10 of 121 posts
Re: Spying on HTTPS
#2Very interesting article, although if the message displayed to the end-user really was left at "You are using an unsupported environment variable: SSLKEYLOGFILE..." that would be truly awful UX with some potentially disastrous consequences.
Re: Spying on HTTPS
#3I said awhile back that QUIC leaving out having a "non-s" mode was going to mean people would just leave keys dumping on :(
Re: Spying on HTTPS
#4There are many problems with using a MITM proxy, however. The primary problem is that it’s very very hard to ensure that it behaves exactly as the browser does and that it does not introduce security vulnerabilities.
FUD. Why should we want "behaves exactly as the browser does", when browsers (in fact, mostly Google's) are in fact turning against their users?
While browser vendors are wary of any sort of interception of HTTPS traffic
Especially Google's, because that's one of the ways you can still block ads and modify pages to have them displayed as the user(-agent) wants, while it continues to slowly remove abilities from browser extensions.
Similarly, the MITM might not support the most secure versions of protocols supported by the browser and the server (e.g. TLS/1.3)
AFAIK there is no general protocol insecurity with TLS this approach is generally preferable to MITM proxies.
...because it provides no way to modify the content, i.e. being able to do things like block ads, inject stylesheets, and generally behave as the user wants.
IMHO the whole "security" thing has turned into a power-grab for companies to enforce their control over users, which is the most disturbing part. We want security, but also control, which is not the "security" they want.
(This comment was posted from a browser that does not support even SSL 2.0, but is using TLS 1.2 via a proxy... and I know that 1.3 will be coming sometime in the future. When that happens, everything that goes through it can also start using 1.3.)
Edit: yay, instant downvotes! I hope you enjoy being herded by Google, because that's where the future is heading if we don't oppose.
Re: Spying on HTTPS
#5There are many problems with using a MITM proxy, however. The primary problem is that it’s very very hard to ensure that it behaves exactly as the browser does and that it does not introduce security vulnerabilities. FUD. Why should we want "behaves exactly as the browser does", when browsers (in fact, mostly Google's) are in fact turning against their users? While browser vendors are wary of any sort of interception…
I assume you've never heard of ISPs or vendors that _inject_ ads and other shenanigans on non-https and decrypted https websites?
Re: Spying on HTTPS
#6There are many problems with using a MITM proxy, however. The primary problem is that it’s very very hard to ensure that it behaves exactly as the browser does and that it does not introduce security vulnerabilities. FUD. Why should we want "behaves exactly as the browser does", when browsers (in fact, mostly Google's) are in fact turning against their users? While browser vendors are wary of any sort of interception…
I assume you've never heard of ISPs or vendors that _inject_ ads and other shenanigans on non-https and decrypted https websites?
That's the ISP's problem. Mine doesn't do that. I trust it more than Google, at any rate.
Re: Spying on HTTPS
#7Earlier quoted context omitted.
I assume you've never heard of ISPs or vendors that _inject_ ads and other shenanigans on non-https and decrypted https websites?
That's the ISP's problem. Mine doesn't do that. I trust it more than Google, at any rate.
Being able to choose your ISP is a luxury many people, especially in the US, do not have. Elsewhere there might be choice, but none are really trustworthy.
This is about disincentivising ISPs. If it's hard for them to pull off, they wouldn't do it and it would become something normal every ISP does.
Re: Spying on HTTPS
#8Earlier quoted context omitted.
That's the ISP's problem. Mine doesn't do that. I trust it more than Google, at any rate.
Being able to choose your ISP is a luxury many people, especially in the US, do not have. Elsewhere there might be choice, but none are really trustworthy. This is about disincentivising ISPs. If it's hard for them to pull off, they wouldn't do it and it would become something normal every ISP does.
> Being able to choose your ISP is a luxury many people, especially in the US, do not have. Elsewhere there might be choice, but none are really trustworthy.
If you don't trust your ISP you really should use a VPN. You still have to trust your ISP if you don't and nothing that megacorps do can help you there.
Re: Spying on HTTPS
#9Earlier quoted context omitted.
That's the ISP's problem. Mine doesn't do that. I trust it more than Google, at any rate.
Being able to choose your ISP is a luxury many people, especially in the US, do not have. Elsewhere there might be choice, but none are really trustworthy. This is about disincentivising ISPs. If it's hard for them to pull off, they wouldn't do it and it would become something normal every ISP does.
This is the thing US brought to itself. Liberal market with minimum regulations. If in my country ISP would touch the traffic, they would get prosecuted by the state. Selling browsing history? Under wiretapping act (you can imagine some jail time). And I can choose between 3 ISPs in country with 2 million people. And optics with at least 100/100 is normal in "larger" city (village in US terms :D) for $60 including iptv and equipment. LTE practically everywhere.
US people will need to start to complain a lot. You are beeing abused.
Re: Spying on HTTPS
#10There are many problems with using a MITM proxy, however. The primary problem is that it’s very very hard to ensure that it behaves exactly as the browser does and that it does not introduce security vulnerabilities. FUD. Why should we want "behaves exactly as the browser does", when browsers (in fact, mostly Google's) are in fact turning against their users? While browser vendors are wary of any sort of interception…
> FUD. Why should we want "behaves exactly as the browser does", when browsers (in fact, mostly Google's) are in fact turning against their users?
Issue of scope. Chrome isn't selectively insecure.
>AFAIK there is no general protocol insecurity with TLS Browsers are very particular about how they communicate certificate validation failures. This is generally obscured by the MITM proxy, as is the certificate itself. Making MITM easy will inevitably lead to people running badly made proxies, especially if such a proxy is installed to the system as adware, the same reason both Chrome and Firefox wouldn't allow random unsigned extensions.
I'd honestly be surprised if any of them do HSTS properly.
>IMHO the whole "security" thing has turned into a power-grab for companies to enforce their control over users, which is the most disturbing part. We want security, but also control, which is not the "security" they want.
You can run dev builds - usually even the official ones - to turn most of those security features off. They're intended for your average non-power user.
>Edit: yay, instant downvotes! I hope you enjoy being herded by Google, because that's where the future is heading if we don't oppose.
That's what you get for making an argument about browser vendors about Google and conflating it with Chrome issues in a different scope.