Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Breaking TLS

markround.com

Post reply on HN
Print view View original

121–130 of 175 posts

Re: Stop Breaking TLS

#121

Post by arianvanp »

jeroenhd wrote: post #72
gschizas wrote: post #11

The fact that most tools have completely different ways to allow them to add certificates is the biggest pain. Git, Python and Rust also have large issues. Git doesn't default to "http.schannel". Python (or rather requests, or maybe urllib3) only looks at its own certificate store, and I have no idea how Rust does this (well, I use uv, and it has its own problems - I know about the --use-native-tls flag, but it shoul…

On Android, macOS/iOS, and Windows, this is a solved problem. Only on the extremely fragmented Linux/Posix runtimes do these problems surface. Rust's solution is "it depends". You can use OpenSSL (system or statically compiled) or rustls (statically compiled with your own CA roots, system CA roots, or WebPKI CA roots). I'm afraid that until the *ix operating systems come out with a new POSIX-like definition that stab…

Is it solved in macOS? Curl recently removed macOS keychain support as there are like 7 competing APIs 6 of which are deprecated and number 6 is a complete HTTP replacement so curl can't use it.

Only reason why it works on macOS curl is because they're a few versions behind

Re: Stop Breaking TLS

#122

Post by Wowfunhappy »

lousken wrote: post #119
Wowfunhappy wrote: post #70

Earlier quoted context omitted.

I'm pretty sure we'd still need to break TLS. Domain-level just isn't granular enough.

I still find that dumb that you even need to do that. Machines especially for schools should be able to have software policies set directly on them to limit such sites. I don't know how much chromeOS is configurable and if you can e.g. force it to only use specific network and network interface, or if a student can connect it to a different network somehow, because it would be kinda pointless otherwise.

The school-issued laptops are all Macbooks. To be clear I'm not in the IT department so I don't know exactly what the setup is, but I see my students using their computers.

A VPN is involved, which is what made me assume they are doing TLS shenanigans—I guess I could theoretically be wrong, but it's definitely more granular than domain-level blocking, so I don't know how else it could work. The computers connect to this VPN automatically on startup. In the moments before the VPN connects, the internet does not work.

> Machines especially for schools should be able to have software policies set directly on them to limit such sites.

It's a good point—if you just did this client-side instead of on the network level, you wouldn't have to deal with TLS or anything. It seems clear to me that they aren't doing that (given the VPN) and it's not immediately obvious to me why.

Re: Stop Breaking TLS

#123

Post by acdha »

cornonthecobra wrote: post #37

> Consider this - what is the likelihood of every certificate authority on the Internet having their private keys compromised simultaneously? Considering that CloudFlare has managed to MitM a huge part of the internet, I'd say that probability is not just non-zero, but greater than by a worrying margin.

That’s not what MITM means, and also misunderstands how CAs work. Cloudflare is a concern for how many people would be affected if there was another Cloudbleed but misstating their relationship with their customers isn’t going to accomplish anything.

Re: Stop Breaking TLS

#124

Post by acdha »

lousken wrote: post #66
Wowfunhappy wrote: post #31

I work for a school. My traffic is not MITM'd, but the kids' traffic is, because we don't want them using their school-issued laptops to play games or go shopping, and you can't adequately block stuff if it's all encrypted.

Whitelists instead of blacklists?

This is really hard to do in practice: for example, if you block YouTube.com you just broke a ton of lesson plans which rely on students watching things like scientific materials from NASA, HHMI, etc. It turns your approval process into a source of political blowback unless it’s really fast, and it’s usually not a good idea to be in your users’ minds negatively all the time.

Re: Stop Breaking TLS

#125

Post by sureglymop »

amiga386 wrote: post #29
sureglymop wrote: post #20

Earlier quoted context omitted.

I have this similar gripe when it comes to http proxy configuration. It's invisible to you until you are in an execution environment where you are mandated to use the providers proxy configuration. Some software reads "expected" env variables for it, some has its own config or cli flags, most just doesn't even bother/care about supporting it.

Chiefly because "supporting it" requires a full JavaScript interpreter, and subscribing to changes in "system settings" during the lifetime of your program. Easier just to support http_proxy/https_proxy/no_proxy (and what standard for no_proxy? Does it support CIDR ranges?) or even less flexibility than that.

If only http_proxy/https_proxy/no_proxy at startup time were more widely supported then. In my case I had to deploy software into a kubernetes cluster managed by a different company that required these configurations.

Re: Stop Breaking TLS

#126

Post by tptacek »

arianvanp wrote: post #18

Complains about TLS inspection, yet fronts their website on the biggest and most widely deployed TLS introspection middle box in the world ... Why do we all disdain local TLS inspection software yet half the Internet terminates their TLS connection at Cloudflare who are most likely giving direct access to US Intelligence? It's so much worse as it's infringing on the privacy and security of billions of innocent people…

The author is not complaining about reverse proxies, which would be a very silly position to take.

Re: Stop Breaking TLS

#127

Post by tptacek »

NicolaiS wrote: post #67
samuel wrote: post #10

I agree with the sentiment, but I think it's a pretty naive view of the issue. Companies will want all info they can in case some of their workers does something illegal-inappropiate to deflect the blame. That's a much more palpable risk than "local CA certificates being compromised or something like that. And some of the arguments are just very easily dismissed. You don't want your employer to see you medical record…

TLS inspection can _never_ be implemented in a good way, you will always have cases where it breaks something and most commonly you will see very bad implementations that break most tools (e.g. it is very hard to trust a new CA because each of OS/browser/java/python/... will have their own CA store) This means devs/users will skip TLS verification ("just make it work") making for a dangerous precedent. Companies want…

Sure it can; it just requires endpoint cooperation, which is a realistic expectation for most corporate IT shops.

Re: Stop Breaking TLS

#128

Post by lisbbb »

I'm glad someone is speaking out about this. When I first found out that the major Fortune 500 company I was working for did this, I was happy I never did any online banking or any personal finance logins using the work computer. It's obscene, quite frankly. I have many criticisms of big-corpo security and how overbearing and paranoid it has become such that developers can barely get a thing done in a lot of these big firms.

Plus, most of the internal threats are embezzlers who get away with it (for awhile, at least). I did work for one place that had a Chinese national attempt to make off with the entire customer database, but he did it by burning CDs (circa 2006).

Re: Stop Breaking TLS

#129

Post by zbentley »

iso1631 wrote: post #101
zbentley wrote: post #90

Earlier quoted context omitted.

That’s vastly more failure prone (crowdstrike crashes workstations) and abuse prone (kernel code has the highest privilege level) than processing network traffic at the network/TLS level.

It's also normally deployed by companies who want this level of access anyway If you don't then you're simply open to encrypted comms over your deep inspection TLS breaking box anyway

Eh, I'm not so sure. Most companies are only somewhat serious about infosec, so they run some light endpoint protection or BYOD, but don't do much network-level restriction on end user devices. For companies in that position, it's much cheaper to do that at the router/VPN endpoint layer with TLS interception--not only is the pricetag of doing that usually a lot lower than the per-seat license of a more capable endpoint protection system, but configuring endpoint protection to allow what it should and not what it shouldn't is a constantly moving target with a failure mode of "breaks someone's workstation and then they have to call IT". IT departments are expensive to staff compared to one or two network administrators issuing edicts about the specific man who is standing in the middle of the SSL link on a particular day.

Also, a lot of nominally serious companies care a lot more about preventing nontechnical employees from watching porn or netflix on company devices/connections than they do about data exfiltration, or any risks posed by employees technical enough to know what phrases like "double encryption" or "TLS MITM evasion" mean.

Re: Stop Breaking TLS

#130

Post by lisbbb »

itopaloglu83 wrote: post #98
sceptic123 wrote: post #86

Earlier quoted context omitted.

I think that's a very loose interpretation of Availability in the CIA triad. This looks a lot like using the MITM hammer to crack every nut. If this is an actual concern, why not deny personal devices access to the network? Why not restrict the applications that can run on company devices? Or provide a separate connection for personal devices/browsing/streaming? Why not treat them like people and actually talk to the…

Yes, but also it’s not an employer’s job to provide entertainment during work hours on a factory floor where there are machines that can kill you if you’re not careful. There’s a famous fable where everyone is questioning the theft victim about what they should’ve done and the victim says “doesn’t the thief deserve some words about not stealing?” Similarly, it’s a corporate network designed and controlled for work pu…

I agree with all you said, but it's not like it is well advertised by the companies--they should come right out and say "we MITM TLS" but they don't. It's all behind the scenes smoke and mirrors.
Post reply on HN