HTTPS Interception Weakens TLS Security
us-cert.gov
HTTPS Interception Weakens TLS Security
1–10 of 105 posts
Re: HTTPS Interception Weakens TLS Security
#2The US government has basically declared "HTTPS/TLS Interception Considered Harmful". This is going to be interesting as all the major security load blanacer/appliances out there offer this as a standard service at this point.
Re: HTTPS Interception Weakens TLS Security
#3It does not have to be. Done correctly, SSL interception can pass through all the errors to the client:
* certificate issues (expiration, domain mismatch, etc.)
* OCSP/CRL verification
* validation of HPKP header
I understand that few vendors may be doing it (I know one which does at least the first 2). Probably the worst offense is choosing the weakest TLS version + cipher to save resources, like using TLS 1.0 because it take less resources to decode/encode than TLS 1.2 + elliptic curve.
Re: HTTPS Interception Weakens TLS Security
#4TL;DR: If your organization is going to do HTTPS interception, don't screw it up.
Re: HTTPS Interception Weakens TLS Security
#5It does not have to be. Done correctly, SSL interception can pass through all the errors to the client: * certificate issues (expiration, domain mismatch, etc.) * OCSP/CRL verification * validation of HPKP header I understand that few vendors may be doing it (I know one which does at least the first 2). Probably the worst offense is choosing the weakest TLS version + cipher to save resources, like using TLS 1.0 becau…
On the other hand, a MITM proxy can also do upgrade "attacks"(?!), communicating with remote servers over the Internet using a stronger protocol than the clients on the LAN behind it support.
In fact it seems to me that having the validation happening in one place may potentially be easier to maintain than across many different clients' software.
Re: HTTPS Interception Weakens TLS Security
#6The US government has basically declared "HTTPS/TLS Interception Considered Harmful". This is going to be interesting as all the major security load blanacer/appliances out there offer this as a standard service at this point.
Watch them change their opinion when the next leak of government information is determined to have happened over an unintercepted TLS connection...
Re: HTTPS Interception Weakens TLS Security
#7The US government has basically declared "HTTPS/TLS Interception Considered Harmful". This is going to be interesting as all the major security load blanacer/appliances out there offer this as a standard service at this point.
As far as I can tell this is targetted at what I would expect: "antivirus" and compliance tools built into firewalls, not reverse proxies built into load balancers.
Re: HTTPS Interception Weakens TLS Security
#8The US government has basically declared "HTTPS/TLS Interception Considered Harmful". This is going to be interesting as all the major security load blanacer/appliances out there offer this as a standard service at this point.
[deleted]
Re: HTTPS Interception Weakens TLS Security
#9It might weaken TLS, but it also stops the 3000 head of cattle I managed from being able to watch porn (6 incidents) and torrent movies (47 copyright notices). If their internet banking, which they're not supposed to be doing at work, gets compromised then I really couldn't care less.
Re: HTTPS Interception Weakens TLS Security
#10Reading the title
... no shit.