Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Breaking TLS

markround.com

Post reply on HN
Print view View original

21–30 of 175 posts

Re: Stop Breaking TLS

#21

Post by Nextgrid »

nikanj wrote: post #13

Companies know that it's important to have Cybersecurity™. A vendor shows up with shiny brochures, and company is happy to purchase Cybersecurity™. Now they don't have to worry about it anymore, they bought a product that sits in the corner and delivers Cybersecurity™

You've perfectly summarized the entire industry.

There's no actual market pressure to be secure, so nobody cares about threat modeling, cost/benefit of security solutions, etc. The only pressure in case of breach is political blame that you need to deflect. The point of a cybersecurity solution is to be there, remind you it is there, and allow you to deflect blame in case of disaster. Whether it actually increases security is merely a bonus side-effect.

Re: Stop Breaking TLS

#22

Post by a012 »

KaiserPro wrote: post #14

Our cyber team have installed zscaler on most people's laptop, and somewhere in the fabric of the office internet connection.[1] For those that don't know, its a MITM proxy with certificates so that it can inspect and unroll TLS traffic. ostensibly its there to stop data exfiltration, as we've had a number of incidents where people have stolen data and sent it to competitors. (our c-suite don't have as much cyber shi…

Security team in most of the corporates is just a bunch of checklists markers, so for zscaler, crowdstrike or whatever they’re doing for compliance and/or certification and you can’t say no to it because it’s the company policy and who know better than “security” team?

Re: Stop Breaking TLS

#23

Post by apexalpha »

apexalpha wrote: post #19

I largely agree with the author. When our SOC wanted to implement TLS inspection I blocked it. Mostly because we not nearly at the security level for this, but also because it just fucks with so many things. That said, we are not a business dealing with highly sensitive data or legal responsibilities surrounding data loss prevention. If you are a business like that, say a bank or a hospital, you want to be able to bl…

Oh and the software (Netskope) was only able to decrypt our traffic in the cloud.

Lmao not in a million fucking years will I upload our data to an American company in fucking plaintext.

Re: Stop Breaking TLS

#24

Post by franga2000 »

I agree with the sentiment, but this part is complete bullshit:

> what is the likelihood of every certificate authority on the Internet having their private keys compromised simultaneously

Who cares? It's not like all CAs would have to be breached, just one. CA certs are not scoped, so the moment one CA gets breached, we're all fucked. CT helps, but AFAIK it's still not enforced everywhere yet

Re: Stop Breaking TLS

#26

Post by johncolanduoni »

immibis wrote: post #17
samuel wrote: post #10

I agree with the sentiment, but I think it's a pretty naive view of the issue. Companies will want all info they can in case some of their workers does something illegal-inappropiate to deflect the blame. That's a much more palpable risk than "local CA certificates being compromised or something like that. And some of the arguments are just very easily dismissed. You don't want your employer to see you medical record…

In Europe they prefer not to go to jail for privacy violations. It turns out most of these "communist" regulations are actually pretty great.

Does GDPR (or similar) establish privacy rights to an employee’s use of a company-owned machine against snooping by their employer? Honest question, I hadn’t heard of that angle. Can employers not install EDR on company-owned machines for EU employees?

Re: Stop Breaking TLS

#27

Post by nly »

"If you use my (private) network you follow my rules"

And I find it hard to argue with that.

I've been using a VPN habitually on my phone and my (personal) laptop for a decade now. Work, home, travel. Doesn't matter. It's always on.

Re: Stop Breaking TLS

#28

Post by noroot »

gschizas wrote: post #11

The fact that most tools have completely different ways to allow them to add certificates is the biggest pain. Git, Python and Rust also have large issues. Git doesn't default to "http.schannel". Python (or rather requests, or maybe urllib3) only looks at its own certificate store, and I have no idea how Rust does this (well, I use uv, and it has its own problems - I know about the --use-native-tls flag, but it shoul…

It's such a nightmare at my current job as well. Everything always just breaks and needs investigating how to fix.

Even putting aside the MITM and how horrendous that is, the amount of time lost from people dealing with the fallout got to have cost so much time (and money). I can't fathom why anyone competent would want to implement this, let alone not see how much friction and safety issues it causes everywhere.

Re: Stop Breaking TLS

#29

Post by amiga386 »

sureglymop wrote: post #20
gschizas wrote: post #11

The fact that most tools have completely different ways to allow them to add certificates is the biggest pain. Git, Python and Rust also have large issues. Git doesn't default to "http.schannel". Python (or rather requests, or maybe urllib3) only looks at its own certificate store, and I have no idea how Rust does this (well, I use uv, and it has its own problems - I know about the --use-native-tls flag, but it shoul…

I have this similar gripe when it comes to http proxy configuration. It's invisible to you until you are in an execution environment where you are mandated to use the providers proxy configuration. Some software reads "expected" env variables for it, some has its own config or cli flags, most just doesn't even bother/care about supporting it.

Chiefly because "supporting it" requires a full JavaScript interpreter, and subscribing to changes in "system settings" during the lifetime of your program. Easier just to support http_proxy/https_proxy/no_proxy (and what standard for no_proxy? Does it support CIDR ranges?) or even less flexibility than that.

Re: Stop Breaking TLS

#30

Post by phito »

arianvanp wrote: post #18

Complains about TLS inspection, yet fronts their website on the biggest and most widely deployed TLS introspection middle box in the world ... Why do we all disdain local TLS inspection software yet half the Internet terminates their TLS connection at Cloudflare who are most likely giving direct access to US Intelligence? It's so much worse as it's infringing on the privacy and security of billions of innocent people…

I wish so too, same for all the self-hosters using tailscale...
Post reply on HN