Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Breaking TLS

markround.com

Post reply on HN
Print view View original

91–100 of 175 posts

Re: Stop Breaking TLS

#91

Post by sqbic »

iso1631 wrote: post #75
sqbic wrote: post #73

What changed my mind to be in favor of TLS inspection at work environments was seeing what kind of highly confidential stuff employees might be copy-pasting to random websites, LLM assistants, cloud-based "desktop applications" and such against the approved use policies of each of these tools without giving it a second thought. TLS inspection products can intercept the paste transaction before the data leaves the com…

So deploy end point security, which sits in the kernel and can thus access the unencrypted communication

While eps, edr, etc. solutions have their role in security and some of the products can be used for "TLS inspection" within the localhost already, doing the inspection in separate network appliance brings benefits such as (but not limited to) not needing to care if the client operating system is supported by the eps product or if the eps is functioning correctly, offloading the "heavy lifting" and policy enforcement to the appliances and ensuring that only actual real egress connections to specific services are inspected.

Re: Stop Breaking TLS

#92

Post by mirashii »

zbentley wrote: post #90
iso1631 wrote: post #75

Earlier quoted context omitted.

So deploy end point security, which sits in the kernel and can thus access the unencrypted communication

That’s vastly more failure prone (crowdstrike crashes workstations) and abuse prone (kernel code has the highest privilege level) than processing network traffic at the network/TLS level.

In practice you don't actually need kernel code on a bunch of platforms for this, e.g. NETransparentProxyManager on MacOS. This is not necessarily an endorsement, just worth not mixing in unrelated issues.

Re: Stop Breaking TLS

#93

Post by newdee »

treesknees wrote: post #80
progbits wrote: post #57

Earlier quoted context omitted.

Tailscale cannot passively observe traffic. They could inject malicious keys into your config but would be hard to mask the evidence of that.

Would it be hard? I thought the point of tailscale was not having to manage or concern yourself with key distribution.

Lookup the Tailnet Lock feature.

Re: Stop Breaking TLS

#94

Post by mirashii »

bandie91 wrote: post #51

personally i'm happy that i can MITM my docker when it wants to pull gigs of images the 1000th time upstream and just serve them from a local OCI cache server instead.

You don't need to MITM docker for this, you can just configure your containerd or equivalent backend properly.

Re: Stop Breaking TLS

#95

Post by itopaloglu83 »

sceptic123 wrote: post #71
itopaloglu83 wrote: post #47

Earlier quoted context omitted.

I’m all for privacy of individuals, but work network is not a public internet either. A solution is required to limit the network to work related activities and also inspect server communications for unusual patterns. In one example someone’s phone was using the work WiFi to “accidentally” stream 20 GB of Netflix a day.

What's the security risk of someone streaming Netflix? There are better ways to ensure people are getting their work done that don't involve spying on them in the name of "security".

What’s wrong with watching Netflix at work instead of working? That’s not for me to say, but I understand employers not wanting to allow it.

Re: Stop Breaking TLS

#96

Post by immibis »

johncolanduoni wrote: post #26
immibis wrote: post #17

Earlier quoted context omitted.

In Europe they prefer not to go to jail for privacy violations. It turns out most of these "communist" regulations are actually pretty great.

Does GDPR (or similar) establish privacy rights to an employee’s use of a company-owned machine against snooping by their employer? Honest question, I hadn’t heard of that angle. Can employers not install EDR on company-owned machines for EU employees?

It has to have a good purpose. Obviously there are a lot of words written about what constitutes a good purpose. Antivirus is probably one. Wanting to intimidate your employees is not. The same thing applies to security cameras.

Privacy laws are about the end-to-end process, not technical implementation. It's not "You can't MITM TLS" - it's more like "You can't spy on your employees". Blocking viruses is not spying on your employees. If you take the logs from the virus blocker and use them to spy on your employees, then you are spying on your employees. (Virus blockers aiming to be sold in the EU would do well not to keep unnecessary logs that could be used to spy on employees.)

Re: Stop Breaking TLS

#97

Post by immibis »

johncolanduoni wrote: post #60
Msurrow wrote: post #53

Earlier quoted context omitted.

Yes. GDPR covers all handling of PII that a company does. And its sort of default deny, meaning that a company is not allowed to handle (process and/or store) your data UNLESS it has a reason that makes it legal. This is where it becomes more blurry: figuring out if the company has a valid reason. Some are simple, eg. if required by law => valid reason. GDPR does not care how the data got “in the hands of” the compan…

What if your employer says “don’t access your health records on our machine”? If you put private health information in your Twitter bio, Twitter is not obligated to suddenly treat it as if they were collecting private health information. Otherwise every single user-provided field would be maximally radioactive under GDPR.

Many programmers tend to treat the legal system as if it was a computer program: if(form.is_public && form.contains(private_health_records)) move(form.owner, get_nearest_jail()); - but this is not how the legal system actually works. Not even in excessively-bureaucratic-and-wording-of-rules-based Germany.

Re: Stop Breaking TLS

#98

Post by itopaloglu83 »

sceptic123 wrote: post #86
treesknees wrote: post #82

Earlier quoted context omitted.

Security takes many forms, including Availability. Having branch offices with 100 Mbps (or less!) Internet connections is still common. I’ve worked tickets where the root cause of network problems such as dropped calls ended up being due to bandwidth constraints. Get enough users streaming Spotify and Netflix and it can get in the way of legitimate business needs. Sure, there’s shaping/qos rules and dns blocking. But…

I think that's a very loose interpretation of Availability in the CIA triad. This looks a lot like using the MITM hammer to crack every nut. If this is an actual concern, why not deny personal devices access to the network? Why not restrict the applications that can run on company devices? Or provide a separate connection for personal devices/browsing/streaming? Why not treat them like people and actually talk to the…

Yes, but also it’s not an employer’s job to provide entertainment during work hours on a factory floor where there are machines that can kill you if you’re not careful.

There’s a famous fable where everyone is questioning the theft victim about what they should’ve done and the victim says “doesn’t the thief deserve some words about not stealing?”

Similarly, it’s a corporate network designed and controlled for work purposes. Connecting your personal devices or doing personal work on work devices is already not allowed per policy, but people still do it, so I don’t blame network admins for blocking such connections.

Re: Stop Breaking TLS

#99

Post by letmetweakit »

redrix wrote: post #46
nly wrote: post #27

"If you use my (private) network you follow my rules" And I find it hard to argue with that. I've been using a VPN habitually on my phone and my (personal) laptop for a decade now. Work, home, travel. Doesn't matter. It's always on.

How do you find your typical daily battery life with it always on? I’ve tried this in the past and had to revert as I found it made a noticeable difference in my day-to-day. Curious to hear the experience of others.

I have the impression tailscale drains my battery on macOS and iOS, only turn it on when truly needed.

Re: Stop Breaking TLS

#100

Post by letmetweakit »

sqbic wrote: post #73

What changed my mind to be in favor of TLS inspection at work environments was seeing what kind of highly confidential stuff employees might be copy-pasting to random websites, LLM assistants, cloud-based "desktop applications" and such against the approved use policies of each of these tools without giving it a second thought. TLS inspection products can intercept the paste transaction before the data leaves the com…

> TLS inspection products can intercept the paste transaction before the data leaves the company network, hitting the user with a "No you didn't! Shame on you!"-banner and notify the admins how a user just tried to paste hundreds of customers' personal information and credit card details into some snooping website, or into otherwise allowed LLM chat which still is not allowed to be used with confidential information."

Are there tools that do this reliably today without a whole bunch of false positives?

Post reply on HN