11–20 of 216 posts
The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.
Note that this happens even when using a BlueCoat proxy in non-MITM mode. BlueCoat tries to "analyze" TLS connections, and rejects anything it doesn't understand. This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0. In this case, it doesn't sound like they're reverting it because of overall breakage, but rather because it breaks the tool that would otherwise be used to control TLS 1.3 tr…
This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0. Good grief! From David Benjamin's final comment: Note these issues are always bugs in the middlebox products. TLS version negotiation is backwards compatible, so a correctly-implemented TLS-terminating proxy should not require changes to work in a TLS-1.3-capable ecosystem. It can simply speak TLS 1.2 at both client proxy and proxy ser…
The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.
Isn't MITM required in enterprise environments where they want to filter content? Unless you want to run it client-side which isn't usually an option.
Then don't filter content.
The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.
Isn't MITM required in enterprise environments where they want to filter content? Unless you want to run it client-side which isn't usually an option.
What these "enterprise environments" want is to leech off the Internet's knowledge while keeping a firm chokehold on the privacy of their own employees Sadly, it looks like Google is caving in to their pressure.
The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.
The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.
I guess in future, TLS upgrades will be opt-in?
The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.
Earlier quoted context omitted.
Isn't MITM required in enterprise environments where they want to filter content? Unless you want to run it client-side which isn't usually an option.
There are ways to filter content without breaking user privacy. For example, you could restrict access to the Internet altogether, and suggest that your users only get what they need from your internal corporate network. See how incredibly productive that makes your staff? What these "enterprise environments" want is to leech off the Internet's knowledge while keeping a firm chokehold on the privacy of their own empl…
All browser vendors provide the necessary bits for properly implemented HTTPS MITM, and have done so for ages (which are fairly simple, basically "allow local trusted certificate roots and ignore key pinning for them").