Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Breaking TLS

markround.com

Post reply on HN
Print view View original

81–90 of 175 posts

Re: Stop Breaking TLS

#81

Post by port11 »

arianvanp wrote: post #18

Complains about TLS inspection, yet fronts their website on the biggest and most widely deployed TLS introspection middle box in the world ... Why do we all disdain local TLS inspection software yet half the Internet terminates their TLS connection at Cloudflare who are most likely giving direct access to US Intelligence? It's so much worse as it's infringing on the privacy and security of billions of innocent people…

Do you have an alternative, potentially one that's less centralised or private or in bed with three-letter agencies? I ask because my last infra was probed for vulnerabilities hundreds of times per day; putting Cloudflare in front with some blocked countries and their captchas brought the attempted attacks down to a few dozen per month.

Re: Stop Breaking TLS

#82

Post by treesknees »

sceptic123 wrote: post #71
itopaloglu83 wrote: post #47

Earlier quoted context omitted.

I’m all for privacy of individuals, but work network is not a public internet either. A solution is required to limit the network to work related activities and also inspect server communications for unusual patterns. In one example someone’s phone was using the work WiFi to “accidentally” stream 20 GB of Netflix a day.

What's the security risk of someone streaming Netflix? There are better ways to ensure people are getting their work done that don't involve spying on them in the name of "security".

Security takes many forms, including Availability.

Having branch offices with 100 Mbps (or less!) Internet connections is still common. I’ve worked tickets where the root cause of network problems such as dropped calls ended up being due to bandwidth constraints. Get enough users streaming Spotify and Netflix and it can get in the way of legitimate business needs.

Sure, there’s shaping/qos rules and dns blocking. But the point is that some networks are no place for personal consumption. If an employer wants to use a MITM box to enforce that, so be it.

Re: Stop Breaking TLS

#83

Post by treesknees »

iso1631 wrote: post #75
sqbic wrote: post #73

What changed my mind to be in favor of TLS inspection at work environments was seeing what kind of highly confidential stuff employees might be copy-pasting to random websites, LLM assistants, cloud-based "desktop applications" and such against the approved use policies of each of these tools without giving it a second thought. TLS inspection products can intercept the paste transaction before the data leaves the com…

So deploy end point security, which sits in the kernel and can thus access the unencrypted communication

Aren’t most TLS implementations still using things like OpenSSL in userspace? How would the kernel get access to the request?

Re: Stop Breaking TLS

#84

Post by dns_snek »

tialaramex wrote: post #34
acer4666 wrote: post #9

Earlier quoted context omitted.

You should make it about CT logs. I believe you need to compromise at least three of them.

The whole point of the logs is that they're tamper-evident. If you think the certificate you've seen wasn't logged you can show proof. If you think the logs tell you something different from everybody else you can prove that too. It is striking that we don't see that. We reliably see people saying "obviously" the Mossad or the NSA are snooping but they haven't shown any evidence that there's tampering

> We reliably see people saying "obviously" the Mossad or the NSA are snooping but they haven't shown any evidence that there's tampering

Why would they use the one approach that leaves a verifiable trace? That'd be foolish.

- They can intercept everything in the comfort of Cloudflare's datacenters

- They can "politely" ask Cloudflare, AWS, Google cloud, etc. to send them a copy of the private keys for certificates that have already been issued

- They either have a backdoor, or have the capability to add a backdoor in the hardware that generates those keys in the first place, should more convenient forms of access fail.

Re: Stop Breaking TLS

#85

Post by iso1631 »

treesknees wrote: post #83
iso1631 wrote: post #75

Earlier quoted context omitted.

So deploy end point security, which sits in the kernel and can thus access the unencrypted communication

Aren’t most TLS implementations still using things like OpenSSL in userspace? How would the kernel get access to the request?

A process with kernel level permissions can patch into userspace process an intercept calls. For example https://github.com/SebastienWae/sslsnoop

Re: Stop Breaking TLS

#86

Post by sceptic123 »

treesknees wrote: post #82
sceptic123 wrote: post #71

Earlier quoted context omitted.

What's the security risk of someone streaming Netflix? There are better ways to ensure people are getting their work done that don't involve spying on them in the name of "security".

Security takes many forms, including Availability. Having branch offices with 100 Mbps (or less!) Internet connections is still common. I’ve worked tickets where the root cause of network problems such as dropped calls ended up being due to bandwidth constraints. Get enough users streaming Spotify and Netflix and it can get in the way of legitimate business needs. Sure, there’s shaping/qos rules and dns blocking. But…

I think that's a very loose interpretation of Availability in the CIA triad.

This looks a lot like using the MITM hammer to crack every nut.

If this is an actual concern, why not deny personal devices access to the network? Why not restrict the applications that can run on company devices? Or provide a separate connection for personal devices/browsing/streaming?

Why not treat them like people and actually talk to them about the potential impacts. Give people personal responsibility for what they do at work.

Re: Stop Breaking TLS

#87

Post by [deleted] »

cornonthecobra wrote: post #40
arianvanp wrote: post #18

Complains about TLS inspection, yet fronts their website on the biggest and most widely deployed TLS introspection middle box in the world ... Why do we all disdain local TLS inspection software yet half the Internet terminates their TLS connection at Cloudflare who are most likely giving direct access to US Intelligence? It's so much worse as it's infringing on the privacy and security of billions of innocent people…

Three of the banks I use have their websites/apps go through CloudFlare. So does the electronic records and messaging system used by my doctor. A lawyer friend uses a secure documents transfer service that is protect by guess who. Who needs to let CF directly onto their network when they already sit between client and provider for critically-private, privileged communications and records access?

[deleted]

Re: Stop Breaking TLS

#88

Post by aprilnya »

arianvanp wrote: post #18

Complains about TLS inspection, yet fronts their website on the biggest and most widely deployed TLS introspection middle box in the world ... Why do we all disdain local TLS inspection software yet half the Internet terminates their TLS connection at Cloudflare who are most likely giving direct access to US Intelligence? It's so much worse as it's infringing on the privacy and security of billions of innocent people…

I think it’s misleading to imply hypocrisy considering the reasons listed in the article don’t apply to the scenario of a site being behind Cloudflare.

Re: Stop Breaking TLS

#89

Post by dmm »

jeroenhd wrote: post #72
gschizas wrote: post #11

The fact that most tools have completely different ways to allow them to add certificates is the biggest pain. Git, Python and Rust also have large issues. Git doesn't default to "http.schannel". Python (or rather requests, or maybe urllib3) only looks at its own certificate store, and I have no idea how Rust does this (well, I use uv, and it has its own problems - I know about the --use-native-tls flag, but it shoul…

On Android, macOS/iOS, and Windows, this is a solved problem. Only on the extremely fragmented Linux/Posix runtimes do these problems surface. Rust's solution is "it depends". You can use OpenSSL (system or statically compiled) or rustls (statically compiled with your own CA roots, system CA roots, or WebPKI CA roots). I'm afraid that until the *ix operating systems come out with a new POSIX-like definition that stab…

> Windows, this is a solved problem.

Are you sure? It's been a few years, but last I tried Firefox used its own CA store on Windows. I'm pretty sure openjdk uses "/jre/lib/security/cacerts" instead of the system store too.

Re: Stop Breaking TLS

#90

Post by zbentley »

iso1631 wrote: post #75
sqbic wrote: post #73

What changed my mind to be in favor of TLS inspection at work environments was seeing what kind of highly confidential stuff employees might be copy-pasting to random websites, LLM assistants, cloud-based "desktop applications" and such against the approved use policies of each of these tools without giving it a second thought. TLS inspection products can intercept the paste transaction before the data leaves the com…

So deploy end point security, which sits in the kernel and can thus access the unencrypted communication

That’s vastly more failure prone (crowdstrike crashes workstations) and abuse prone (kernel code has the highest privilege level) than processing network traffic at the network/TLS level.
Post reply on HN