Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Breaking TLS

markround.com

Post reply on HN
Print view View original

101–110 of 175 posts

Re: Stop Breaking TLS

#101

Post by iso1631 »

zbentley wrote: post #90
iso1631 wrote: post #75

Earlier quoted context omitted.

So deploy end point security, which sits in the kernel and can thus access the unencrypted communication

That’s vastly more failure prone (crowdstrike crashes workstations) and abuse prone (kernel code has the highest privilege level) than processing network traffic at the network/TLS level.

It's also normally deployed by companies who want this level of access anyway

If you don't then you're simply open to encrypted comms over your deep inspection TLS breaking box anyway

Re: Stop Breaking TLS

#102

Post by ectospheno »

redrix wrote: post #46
nly wrote: post #27

"If you use my (private) network you follow my rules" And I find it hard to argue with that. I've been using a VPN habitually on my phone and my (personal) laptop for a decade now. Work, home, travel. Doesn't matter. It's always on.

How do you find your typical daily battery life with it always on? I’ve tried this in the past and had to revert as I found it made a noticeable difference in my day-to-day. Curious to hear the experience of others.

I have an ipv6 wireguard vpn from my iOS phone to my home network. It routes all traffic through my home isp. I use the wireguard iOS client. Battery life has been fine for me. One caveat is that background updates are disabled for almost every app.

Re: Stop Breaking TLS

#103

Post by OptionOfT »

arianvanp wrote: post #18

Complains about TLS inspection, yet fronts their website on the biggest and most widely deployed TLS introspection middle box in the world ... Why do we all disdain local TLS inspection software yet half the Internet terminates their TLS connection at Cloudflare who are most likely giving direct access to US Intelligence? It's so much worse as it's infringing on the privacy and security of billions of innocent people…

The certificate presented is not a Cloudflare one.

So it might be that they're using a custom one, which I believe is passed through end-to-end.

Re: Stop Breaking TLS

#104

Post by newdee »

letmetweakit wrote: post #99
redrix wrote: post #46

Earlier quoted context omitted.

How do you find your typical daily battery life with it always on? I’ve tried this in the past and had to revert as I found it made a noticeable difference in my day-to-day. Curious to hear the experience of others.

I have the impression tailscale drains my battery on macOS and iOS, only turn it on when truly needed.

Yeah, it most certainly does. Very noticeable on iOS. I don’t know if this is an Apple specific thing, or if it’s a similar story on Android.

It’s WireGuard underneath, which is designed to not be very chatty when idle, so I’d put this down to regular back and forth with Tailscale’s control plane, relays, etc.

It’s a shame really, because a huge value prop of TS is that it’s a VPN you just leave on and forget about. I hate having to toggle it when I inevitably forget to and wonder why I’m getting connection errors to private resources.

Re: Stop Breaking TLS

#105

Post by johncolanduoni »

samuel wrote: post #78
johncolanduoni wrote: post #62

Earlier quoted context omitted.

So does nobody in Europe use an EDR or intercepting proxy since GDPR went into force?

I have found a definite answer from the Dutch Protection Agency (although it could be out of date). https://english.ncsc.nl/binaries/ncsc-en/documenten/factshee...

What’s the definitive answer? From what I can tell that document is mostly about security risks and only mentions privacy compliance in a single paragraph (with no specific guidance). It definitely doesn’t say you can or can’t use one.

Re: Stop Breaking TLS

#106

Post by johncolanduoni »

immibis wrote: post #97
johncolanduoni wrote: post #60

Earlier quoted context omitted.

What if your employer says “don’t access your health records on our machine”? If you put private health information in your Twitter bio, Twitter is not obligated to suddenly treat it as if they were collecting private health information. Otherwise every single user-provided field would be maximally radioactive under GDPR.

Many programmers tend to treat the legal system as if it was a computer program: if(form.is_public && form.contains(private_health_records)) move(form.owner, get_nearest_jail()); - but this is not how the legal system actually works. Not even in excessively-bureaucratic-and-wording-of-rules-based Germany.

Yeah, that’s my point. I don’t understand why the fact that you could access a bunch of personal data via your work laptop in express violation of the laptop owner’s wishes would mean that your company has the same responsibilities to protect it that your doctor’s office does. That’s definitely not how it works in general.

Re: Stop Breaking TLS

#107

Post by dingaling »

jeroenhd wrote: post #72
gschizas wrote: post #11

The fact that most tools have completely different ways to allow them to add certificates is the biggest pain. Git, Python and Rust also have large issues. Git doesn't default to "http.schannel". Python (or rather requests, or maybe urllib3) only looks at its own certificate store, and I have no idea how Rust does this (well, I use uv, and it has its own problems - I know about the --use-native-tls flag, but it shoul…

On Android, macOS/iOS, and Windows, this is a solved problem. Only on the extremely fragmented Linux/Posix runtimes do these problems surface. Rust's solution is "it depends". You can use OpenSSL (system or statically compiled) or rustls (statically compiled with your own CA roots, system CA roots, or WebPKI CA roots). I'm afraid that until the *ix operating systems come out with a new POSIX-like definition that stab…

I absolutely do not want to be constrained to a single system cert store controlled by the OS vendor.

Re: Stop Breaking TLS

#108

Post by immibis »

johncolanduoni wrote: post #105
samuel wrote: post #78

Earlier quoted context omitted.

I have found a definite answer from the Dutch Protection Agency (although it could be out of date). https://english.ncsc.nl/binaries/ncsc-en/documenten/factshee...

What’s the definitive answer? From what I can tell that document is mostly about security risks and only mentions privacy compliance in a single paragraph (with no specific guidance). It definitely doesn’t say you can or can’t use one.

That's probably because there is no answer. Many laws apply to the total thing you are creating end-to-end.

Even the most basic law like "do not murder" is not "do not pull gun triggers" and a gun's technical reference manual would only be able to give you a vague statement like "Be aware of local laws before activating the device."

Legal privacy is not about whether you intercept TLS or not; it's about whether someone is spying on you, which is an end-to-end operation. Should someone be found to be spying on you, then you can go to court and they will decide who has to pay the price for that. And that decision can be based on things like whether some intermediary network has made poor security decisions.

This is why corporations do bullshit security by the way. When we on HN say "it's for liability reasons" this is what it means - it means when a court is looking at who caused a data breach, your company will have plausible deniability. "Your Honour, we use the latest security system from CrowdStrike" sounds better than "Your Honour, we run an unpatched Unix system from 1995 and don't connect it to the Internet" even though us engineers know the latter is probably more secure against today's most common attacks.

Re: Stop Breaking TLS

#109

Post by johncolanduoni »

Msurrow wrote: post #64
johncolanduoni wrote: post #60

Earlier quoted context omitted.

What if your employer says “don’t access your health records on our machine”? If you put private health information in your Twitter bio, Twitter is not obligated to suddenly treat it as if they were collecting private health information. Otherwise every single user-provided field would be maximally radioactive under GDPR.

If the employer says so and I do so anyway then that’s a employment issue. I still have to follow company rules. But the point is that the company needs to delete the collected data as soon as possible. They are still not allowed to store it.

I’ll give an example in more familiar with. In the US, HIPPA has a bunch of rules about how private health information can be handled by everyone in the supply chain, from doctor’s offices to medical record SaaS systems. But if I’m running a SaaS note taking app and some doctor’s office puts PHI in there without an express contract with me saying they could, I’m not suddenly subject to enforcement. It all falls on them.

I’m trying to understand the GDPR equivalent of this, which seems to exist since every text fields in a database does not appear to require the full PII treatment in practice (and that would be kind of insane).

Re: Stop Breaking TLS

#110

Post by johncolanduoni »

immibis wrote: post #108
johncolanduoni wrote: post #105

Earlier quoted context omitted.

What’s the definitive answer? From what I can tell that document is mostly about security risks and only mentions privacy compliance in a single paragraph (with no specific guidance). It definitely doesn’t say you can or can’t use one.

That's probably because there is no answer. Many laws apply to the total thing you are creating end-to-end. Even the most basic law like "do not murder" is not "do not pull gun triggers" and a gun's technical reference manual would only be able to give you a vague statement like "Be aware of local laws before activating the device." Legal privacy is not about whether you intercept TLS or not; it's about whether someo…

Okay, thanks for explaining the general concept of law to me, but this provides literally no information to figure out the conditions under which an employer using a TLS intercepting proxy to snoop on the internet traffic a work laptop violates GDPR. I never asked for a definitive answer just, you know, an answer that is remotely relevant to the question.

I don’t really need to know, but a bunch of people seemed really confident they knew the answer and then provided no actual information except vague gesticulation about PII.

Post reply on HN