Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spying on HTTPS

textslashplain.com

Post reply on HN
Print view View original

91–100 of 121 posts

Re: Spying on HTTPS

#91

Post by danShumway »

jraph wrote: post #89
mises wrote: post #87

Earlier quoted context omitted.

There is a technical reason. I may know, but Google does not. I look up "Man in the Middle" and get many years worth of useful info. I look up "Monster in the Middle", and here's what I get: one result about a cloudflare project, one bodybuilding.com post, one disney wiki post, and several you tube videos about "HuggleMonsters". After those is this discussion. Does that sound like a really good term to use? This look…

If the expression spreads, search engines will start showing relevant results. If it does not spread, then we are facing a non-issue.

To add to this, search engines already need to correlate "MITM" and "Man in the Middle". But we don't see anyone here arguing that the expanded form should be preferred to make searching between those two forms easier.

Correlating terms turns out to be a pretty easy problem. It's overlapping terms like "Mongoose (Animal)" and "Mongoose (Database)" that are hard.

Re: Spying on HTTPS

#92

Post by jraph »

mises wrote: post #86
jraph wrote: post #33

Earlier quoted context omitted.

I would like person-in-the-middle attack, but unfortunately PITM would not be recognized as well as MITM. And in fact, it seems that we shouldn't really care so much that a person is in the middle, so we might be better off saying "in-the-middle attack" (ITM) anyway. Today, "man-in-the-middle" sounds familiar but I wonder if in a few decades, saying "man" instead of "person" or "human" will bear more meaning than tod…

> We already got gender neutral pronouns in English, for which we are seeing a wide adoption now, and new pronouns feel like a pretty big change, much bigger than an evolution of the MITM expression. Huh? We don't have such pronouns in English. The closest is perhaps the plural "they". I've heard some mutterings about weird, made-up ones, but they seem very fringe and pushed solely for political reasons rather than a…

I was thinking about singular they and its derivatives: their, theirs, them. Plural they is also gender-neutral, but its usage is not new nor controversial.

Defending the use of gender-neutral pronouns was not my point, but since you ask what purpose they would serve, here are some reasons I can think of (and this answer is not limited to English):

- to avoid having to specify or think about the gender(s) of the referred person(s), which may be unknown or irrelevant to the subject (to illustrate what I am saying: for instance, if a scientist found something, I don't really care whether they have blue eyes, or breasts, or testicles, or red hair, right, and if I cared, it would still be irrelevant to the discovery in most cases - not always, though: https://www.nature.com/news/male-researchers-stress-out-rode...).

- some people who prefer to be referred to using they (I know some personally, and there was a submission on HN whose author wants that we use they to refer to… them). We therefore should use "they" for them.

- some people do not see themselves as neither male nor female, so a gender-neutral pronoun is convenient for them, and for other people to speak about them.

Re: Spying on HTTPS

#93

Post by xg15 »

sascha_sl wrote: post #10
userbinator wrote: post #4

There are many problems with using a MITM proxy, however. The primary problem is that it’s very very hard to ensure that it behaves exactly as the browser does and that it does not introduce security vulnerabilities. FUD. Why should we want "behaves exactly as the browser does", when browsers (in fact, mostly Google's) are in fact turning against their users? While browser vendors are wary of any sort of interception…

> FUD. Why should we want "behaves exactly as the browser does", when browsers (in fact, mostly Google's) are in fact turning against their users? Issue of scope. Chrome isn't selectively insecure. >AFAIK there is no general protocol insecurity with TLS Browsers are very particular about how they communicate certificate validation failures. This is generally obscured by the MITM proxy, as is the certificate itself. M…

> I'd honestly be surprised if any of them do HSTS properly.

Maybe I'm missing something, but what would an MITM proxy have to do here as long as it passes the HSTS headers on to the browser?

As far as I understand, HSTS changes browser behavior in two places:

- A browser will always connect to a domain via HTTPS, even if the URL says HTTP. - TLS errors become unskippable.

Both behaviors are carried out by the browser and are not influenced by the specifics of the TLS connection itself (as long as a connection can be established).

> You can run dev builds - usually even the official ones - to turn most of those security features off. They're intended for your average non-power user.

But this is about average non-power users. Because the current trends force those users to place their complete trust in browser vendors or website operators, even if there were local administrators or third-party tools who could do a better job.

Re: Spying on HTTPS

#95

Post by stordoff »

tzs wrote: post #74
burkaman wrote: post #25

Earlier quoted context omitted.

I have seen it in at least one other project: https://blog.cloudflare.com/monsters-in-the-middleboxes/ , https://github.com/cloudflare/mitmengine I think it's equally understandable, and monster is objectively a more fun word. Seems like not a big deal?

Monster has negative connotations. The word he should have used, if an alternative to "Man" is needed, is "Marklar". No negative connotations, and is objectively even more fun than "Monster".

This is noted in the comments:

> Some have protested that "monster" has negative connotations, but anyone who grew up with Sesame Street or modern Disney movies knows that’s an unfair stereotype. And Monster is more fun. You like fun, don't you? Don't you?!?

Re: Spying on HTTPS

#96

Post by xg15 »

minitech wrote: post #81
xg15 wrote: post #77

Ok, dumb question. If apparently any kind of technique to intercept an HTTPS stream makes security experts frown, how are you actually supposed to inspect them if you have a legitimate reason? (e.g. monitoring unusual behavior of your own system) Or is the security best-practice to just trust any app not to upload my contact list?

The SSLKEYLOGFILE approach is a good one; the warning being considered for Chrome just makes it clear when it’s in use. (Not that you could detect it by inspecting decrypted HTTPS if a closed-source app really wanted to secretly upload your contact list. In that sense, security best practice is minimal app permissions and reproducible builds.)

> Not that you could detect it by inspecting decrypted HTTPS if a closed-source app really wanted to secretly upload your contact list.

In theory yes. If every app had their own hand-crafted binary format, scanners would be out of luck. However, in practice, developers value existing tooling and most of the actual data on the wire seems to be formatted in a manageable number of well-known formats (JSON, XML, url params, protocol buffers, etc). If nothing else, a scanner could at least find out with some reasonable certainty that an app is trying to obfuscate something.

I think the amount of detection and analysis tools that exist give some hinds that even if you cannot analyze everything, there is a lot of things you can find out.

> In that sense, security best practice is minimal app permissions and reproducible builds.

Reproducible builds of what? We haven't even got this to work for most open-source software and with closed-source software, you per defintion doesn't even have anything to build in the first place.

Re: Spying on HTTPS

#97

Post by xg15 »

zzzcpan wrote: post #23
userbinator wrote: post #4

There are many problems with using a MITM proxy, however. The primary problem is that it’s very very hard to ensure that it behaves exactly as the browser does and that it does not introduce security vulnerabilities. FUD. Why should we want "behaves exactly as the browser does", when browsers (in fact, mostly Google's) are in fact turning against their users? While browser vendors are wary of any sort of interception…

Yes, "security" push from corporations has been a joke for years already. I guess they see that people buy it, push it even farther and lock down everything they can under that excuse. But we can still survive it, Google is afraid of something and keeps a usable browser open source. And if things go south it won't be hard for a browser fork to implement a proper feature to allow interception of network requests befor…

As long as there is still something where you can install that browser. Most interesting new hardware is itself increasingly locked down.

Re: Spying on HTTPS

#98

Post by a1369209993 »

xg15 wrote: post #77

Ok, dumb question. If apparently any kind of technique to intercept an HTTPS stream makes security experts frown, how are you actually supposed to inspect them if you have a legitimate reason? (e.g. monitoring unusual behavior of your own system) Or is the security best-practice to just trust any app not to upload my contact list?

> how are you actually supposed to inspect them if you have a legitimate reason?

By shoving your middlebox somewhere anatomically improbable.

> monitoring unusual behavior of your own system

Anything that tries to connect to the internet for a reason that you didn't both understand and ask for in advance is malware.

> Or is the security best-practice to just trust any app not to upload my contact list?

Yes. That is it exactly.

Re: Spying on HTTPS

#99

Post by jraph »

danShumway wrote: post #90
mises wrote: post #86

Earlier quoted context omitted.

> We already got gender neutral pronouns in English, for which we are seeing a wide adoption now, and new pronouns feel like a pretty big change, much bigger than an evolution of the MITM expression. Huh? We don't have such pronouns in English. The closest is perhaps the plural "they". I've heard some mutterings about weird, made-up ones, but they seem very fringe and pushed solely for political reasons rather than a…

Singular "they" has been used for hundreds of years dating back to the 14th century -- comparatively, it's a very modern trend for people to say that it should only be used in the plural. Even forms like "themself" have a pretty long historical precedent. > what purpose would a "gender-neutral" pronoun serve? From a technical perspective, these pronouns allow you to refer to a single person without prescribing their[…

I was also going to speak about the descriptive and prescriptive approaches to languages, and then dropped my paragraphs because it was not clear to me whether OP acknowledged that singular they was a thing in English. I decided to consider that they effectively acknowledged singular they.

By taking a prescriptive approach (telling how people should speak English), maybe singular they can be deemed invalid in English… depending on who is prescribing the usage. But people taking a prescriptive approach do not agree between each others, and even if they did, they would never represent the wide, heterogeneous set of English-speaking people.

Case in point: they do not agree here, but the usage of singular they seems to be more and more recognized / recommended [1]. A descriptive approach will acknowledge a widespread use of anything, regardless of the reasons why things are used.

About politics and languages. Politics are constantly shaping the language. This is not new. It's part of the natural evolution of languages. Politics are not inherently bad neither. We don't have slaves anymore in most countries, thanks to "politics".

Actually, I find politics is actually too vague a word, and some people seem to invoke it as a bad thing, saying that we should focus on technical matters when their view opposes the view of people seeing something belonging to the status quo as an issue (which is a political stance in itself… and considering that technical matters and politics are opposed too, ironically).

You can't really reject an idea "because politics". You may either argue, or disagree respectfully, but there is no such thing as avoiding politics and remaining technical.

[1] https://en.wikipedia.org/wiki/Singular_they#Acceptability_an...

Re: Spying on HTTPS

#100

Post by userbinator »

minitech wrote: post #55
userbinator wrote: post #4

There are many problems with using a MITM proxy, however. The primary problem is that it’s very very hard to ensure that it behaves exactly as the browser does and that it does not introduce security vulnerabilities. FUD. Why should we want "behaves exactly as the browser does", when browsers (in fact, mostly Google's) are in fact turning against their users? While browser vendors are wary of any sort of interception…

> FUD. Why should we want "behaves exactly as the browser does", when browsers (in fact, mostly Google's) are in fact turning against their users? To avoid introducing vulnerabilities, the way lots of antivirus MITMs do, for example. Like it says in the rest of your quote. > Especially Google's, because that's one of the ways you can still block ads and modify pages to have them displayed as the user(-agent) wants, w…

Extensions are very much a better tool for that. The idea that browser vendors are going to slowly cripple them so that they’re no longer an effective blocking tool is… wrong

Did you not see this at all? https://news.ycombinator.com/item?id=20044430

Don’t.

You're certainly displaying your allegiance to Big G...

Post reply on HN