101–105 of 105 posts
It might weaken TLS, but it also stops the 3000 head of cattle I managed from being able to watch porn (6 incidents) and torrent movies (47 copyright notices). If their internet banking, which they're not supposed to be doing at work, gets compromised then I really couldn't care less.
I know my organisation do SSL inspection, but they have whitelisted common personal websites like internet banking to protect the privacy of staff.
As far as I'm concerned, if your risk profile requires you to do SSL inspection then this is the right way to do it.
Reading the title ... no shit.
Exactly my idea, but after reading the article I'm severely disappointed that the whole practice isn't declared bad. Instead it only points out that some mitm boxes are even more broken than I though possible and mess up cert validation.
and I'm a dev at one of these companies!
We really didn't want to add the feature but we were bleeding customer's who for some reason had to have it. ( Yes, we do validate the certificates )
We decided to bite the bullet when it looked like even Google was "supporting" being mitmed as a customer pointed out.
Reading this article... https://support.google.com/a/answer/1668854?hl=en
was my biggest "fuck you" moment.
It might weaken TLS, but it also stops the 3000 head of cattle I managed from being able to watch porn (6 incidents) and torrent movies (47 copyright notices). If their internet banking, which they're not supposed to be doing at work, gets compromised then I really couldn't care less.
1. Snooping on their internet banking is ILLEGAL for you to do and puts YOU in hot water. You realize you could be put out of business by lawsuits right?