Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spying on HTTPS

textslashplain.com

Post reply on HN
Print view View original

81–90 of 121 posts

Re: Spying on HTTPS

#81

Post by minitech »

xg15 wrote: post #77

Ok, dumb question. If apparently any kind of technique to intercept an HTTPS stream makes security experts frown, how are you actually supposed to inspect them if you have a legitimate reason? (e.g. monitoring unusual behavior of your own system) Or is the security best-practice to just trust any app not to upload my contact list?

The SSLKEYLOGFILE approach is a good one; the warning being considered for Chrome just makes it clear when it’s in use.

(Not that you could detect it by inspecting decrypted HTTPS if a closed-source app really wanted to secretly upload your contact list. In that sense, security best practice is minimal app permissions and reproducible builds.)

Re: Spying on HTTPS

#82

Post by xg15 »

jraph wrote: post #35
zzzcpan wrote: post #28

Earlier quoted context omitted.

It shifts the narrative to demonize MITM. Ironic seeing a Cloudflare link, given that they are MITMing all traffic. You are not a monster if you are doing it, it's corporations who are monsters if they try to prevent you from doing it and you are fighting for freedom from them. So it's freedom-in-the-middle.

It depends on the point of view and the situation. If you are a free software developer reverse-engineering a graphics driver, you sure want to be able to intercept the traffic between the graphics card and the CPU (I don't do driver development so I might be completely off, but I hope you get the point anyway). However, if you are having a conversation with a secret source, you want this freedom to not be intercepte…

Yes, those are the extremes. But the more common case seems to me that you are an app developer selling user data.

In this scenario, the app developer certainly has an interest not to be intercepted, however the user and actual owner of the device likely would benefit from interception.

Re: Spying on HTTPS

#83

Post by xg15 »

minitech wrote: post #81
xg15 wrote: post #77

Ok, dumb question. If apparently any kind of technique to intercept an HTTPS stream makes security experts frown, how are you actually supposed to inspect them if you have a legitimate reason? (e.g. monitoring unusual behavior of your own system) Or is the security best-practice to just trust any app not to upload my contact list?

The SSLKEYLOGFILE approach is a good one; the warning being considered for Chrome just makes it clear when it’s in use. (Not that you could detect it by inspecting decrypted HTTPS if a closed-source app really wanted to secretly upload your contact list. In that sense, security best practice is minimal app permissions and reproducible builds.)

It's also formulated in a way that clearly implicates "this is bad, don't do that!".

The warning makes sense if shown as part of a shortlived debug session to a developer. However, this is caused by a program that a non-technical user has installed permanently on the device.

So I'm confused how legitimate TLS inspection is supposed to work for this user group.

Re: Spying on HTTPS

#84

Post by silverfox17 »

xg15 wrote: post #77

Ok, dumb question. If apparently any kind of technique to intercept an HTTPS stream makes security experts frown, how are you actually supposed to inspect them if you have a legitimate reason? (e.g. monitoring unusual behavior of your own system) Or is the security best-practice to just trust any app not to upload my contact list?

All sorts of places intercept HTTPS if they deem it reasonable. There are a wide variety of security products out there for such things.

Re: Spying on HTTPS

#85

Post by theamk »

xg15 wrote: post #83
minitech wrote: post #81

Earlier quoted context omitted.

The SSLKEYLOGFILE approach is a good one; the warning being considered for Chrome just makes it clear when it’s in use. (Not that you could detect it by inspecting decrypted HTTPS if a closed-source app really wanted to secretly upload your contact list. In that sense, security best practice is minimal app permissions and reproducible builds.)

It's also formulated in a way that clearly implicates "this is bad, don't do that!". The warning makes sense if shown as part of a shortlived debug session to a developer. However, this is caused by a program that a non-technical user has installed permanently on the device. So I'm confused how legitimate TLS inspection is supposed to work for this user group.

I think the Google's answer is, "it isn't supposed to work"

They pretty clearly believe that they should be the only ones controlling the web experience.

Re: Spying on HTTPS

#86

Post by mises »

jraph wrote: post #33
Rudi9719 wrote: post #17

Earlier quoted context omitted.

Gender neutral and more accurate, it might not be how everyone else uses it but you got the meaning, no?

I would like person-in-the-middle attack, but unfortunately PITM would not be recognized as well as MITM. And in fact, it seems that we shouldn't really care so much that a person is in the middle, so we might be better off saying "in-the-middle attack" (ITM) anyway. Today, "man-in-the-middle" sounds familiar but I wonder if in a few decades, saying "man" instead of "person" or "human" will bear more meaning than tod…

> We already got gender neutral pronouns in English, for which we are seeing a wide adoption now, and new pronouns feel like a pretty big change, much bigger than an evolution of the MITM expression.

Huh? We don't have such pronouns in English. The closest is perhaps the plural "they". I've heard some mutterings about weird, made-up ones, but they seem very fringe and pushed solely for political reasons rather than as a natural evolution of language.

More importantly, what purpose would a "gender-neutral" pronoun serve?

Re: Spying on HTTPS

#87

Post by mises »

danShumway wrote: post #60
rumanator wrote: post #52

Earlier quoted context omitted.

Your attempt to force your personal blend of newspeak onto the world has no place in tech nor in this discussion. Please leave your gender politics activism out of an interesting technical discussion that affects us all. Besides being pointless and stupid, it only adds noise to the debate.

Discussions should get more civil over time, not less. GP never mentions gender in their post, but in terms of politics, it seems to me that this entire thread is a political conversation. It's certainly not technical -- a technical person would not care about whether someone used the term "monster" or "man", since: a) it changes literally nothing about the technical details of the attack. b) everyone understands wha…

There is a technical reason. I may know, but Google does not. I look up "Man in the Middle" and get many years worth of useful info. I look up "Monster in the Middle", and here's what I get: one result about a cloudflare project, one bodybuilding.com post, one disney wiki post, and several you tube videos about "HuggleMonsters". After those is this discussion. Does that sound like a really good term to use? This looks like some one at cloud flare got pc and used the term, then this guy got in on it. I see no reason to let some company decide what's proper; I'd rather go for decades of security and development expertise.

Re: Spying on HTTPS

#88

Post by ldoughty »

xg15 wrote: post #78
Rudi9719 wrote: post #16

Honest question, is it possible to have chrome disable the functionality to export the SSL private key? IE on that notification is there a button to deny the stream?

To my understanding, this exports the session keys of an active TLC connection. Those are temporary keys that were created during the handshake of a particular TLS connection and are only valid for this particular connection. So, if this data is picked up immediately by a network sniffer, it can decrypt the currently active TLS connection. However, the keys will not allow anyone to decrypt any past or future connecti…

This should be correct. This is super useful for developers and operations people to debug traffic ... Or for security/monitoring software (e.g. company or parents monitoring people). But limited use otherwise. Considering the hoops you go through to turn this in, this is usually okay, but it is not necessarily apparent to end users when it is on.

Re: Spying on HTTPS

#89

Post by jraph »

mises wrote: post #87
danShumway wrote: post #60

Earlier quoted context omitted.

Discussions should get more civil over time, not less. GP never mentions gender in their post, but in terms of politics, it seems to me that this entire thread is a political conversation. It's certainly not technical -- a technical person would not care about whether someone used the term "monster" or "man", since: a) it changes literally nothing about the technical details of the attack. b) everyone understands wha…

There is a technical reason. I may know, but Google does not. I look up "Man in the Middle" and get many years worth of useful info. I look up "Monster in the Middle", and here's what I get: one result about a cloudflare project, one bodybuilding.com post, one disney wiki post, and several you tube videos about "HuggleMonsters". After those is this discussion. Does that sound like a really good term to use? This look…

If the expression spreads, search engines will start showing relevant results. If it does not spread, then we are facing a non-issue.

Re: Spying on HTTPS

#90

Post by danShumway »

mises wrote: post #86
jraph wrote: post #33

Earlier quoted context omitted.

I would like person-in-the-middle attack, but unfortunately PITM would not be recognized as well as MITM. And in fact, it seems that we shouldn't really care so much that a person is in the middle, so we might be better off saying "in-the-middle attack" (ITM) anyway. Today, "man-in-the-middle" sounds familiar but I wonder if in a few decades, saying "man" instead of "person" or "human" will bear more meaning than tod…

> We already got gender neutral pronouns in English, for which we are seeing a wide adoption now, and new pronouns feel like a pretty big change, much bigger than an evolution of the MITM expression. Huh? We don't have such pronouns in English. The closest is perhaps the plural "they". I've heard some mutterings about weird, made-up ones, but they seem very fringe and pushed solely for political reasons rather than a…

Singular "they" has been used for hundreds of years dating back to the 14th century -- comparatively, it's a very modern trend for people to say that it should only be used in the plural. Even forms like "themself" have a pretty long historical precedent.

> what purpose would a "gender-neutral" pronoun serve?

From a technical perspective, these pronouns allow you to refer to a single person without prescribing their[0] gender. This may have the effect of making some technical writing more accessible.

From a narrative perspective, these pronouns allow you to write about a character who's gender you might not want to reveal yet[1].

And from a political perspective, these pronouns allow individual to assert that they are nonbinary. The political perspective is what gets people annoyed, but it's worth noting that both language and politics are a reflection of society. It's normal for one to influence the other. It's because of this that we consider language and grammar rules to be descriptive, not prescriptive -- they simply describe the words that people use, even if those words are being used for a political purpose.

Ignoring politics, why not use "he" as the gender neutral form and get rid of "they"? For the same reason why it can occasionally be annoying for `0` to be automatically cast to the boolean false in languages like Javascript. If I use the word "he", I don't want someone to have guess whether I'm using it in the gender neutral form or if I'm literally describing the person's gender. Singular "they" serves as a strict typecheck -- it makes "he" into a more useful word because you can use it exclusively to refer to male subjects.

[0]: Also note the usage of singular "their" here, which is almost universally accepted. I've never heard someone argue that we should get rid of singular "their" just because we already have "his" and "her".

[1]: "The cloaked thief stepped into the house. Their eyes scanned left and right, as if they couldn't decide what they wanted to take first." Is the thief a man or a woman? Only the detective will know!

Post reply on HN