Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Breaking TLS

markround.com

Post reply on HN
Print view View original

131–140 of 175 posts

Re: Stop Breaking TLS

#131

Post by xp84 »

dingaling wrote: post #107
jeroenhd wrote: post #72

Earlier quoted context omitted.

On Android, macOS/iOS, and Windows, this is a solved problem. Only on the extremely fragmented Linux/Posix runtimes do these problems surface. Rust's solution is "it depends". You can use OpenSSL (system or statically compiled) or rustls (statically compiled with your own CA roots, system CA roots, or WebPKI CA roots). I'm afraid that until the *ix operating systems come out with a new POSIX-like definition that stab…

I absolutely do not want to be constrained to a single system cert store controlled by the OS vendor.

That last part does sound like a bad deal based on recent anti-owner-control habits like sealed immutable system volumes, but I definitely want to be constrained to a single system cert store controlled by the owner of a computer. Which works for the corporate case as well as the personal one.

Re: Stop Breaking TLS

#132

Post by lisbbb »

a012 wrote: post #22
KaiserPro wrote: post #14

Our cyber team have installed zscaler on most people's laptop, and somewhere in the fabric of the office internet connection.[1] For those that don't know, its a MITM proxy with certificates so that it can inspect and unroll TLS traffic. ostensibly its there to stop data exfiltration, as we've had a number of incidents where people have stolen data and sent it to competitors. (our c-suite don't have as much cyber shi…

Security team in most of the corporates is just a bunch of checklists markers, so for zscaler, crowdstrike or whatever they’re doing for compliance and/or certification and you can’t say no to it because it’s the company policy and who know better than “security” team?

The problem I have with them is they are a no-talent crowd who enjoy pushing everyone around.

Re: Stop Breaking TLS

#133

Post by lisbbb »

NicolaiS wrote: post #15

Got acquired by a Fortune 500 and recieved new laptop. First hour I'm seeing TLS errors everywhere except the browser. They'd half-baked their internal CA rollout, so wasn't trusted properly. By day two I started validating their setup. The CA literally had a typo in the company name, not a great sign. A quick check with badssl.com showed that any self-signed(!) cert was being transparently MITM'ed and re-signed by t…

I've experienced similar. It has definitely made me less enthusiastic about working for any of those fools ever again. It's all just an exercise in mediocrity. The illiterate emails people send out are even worse--I swear that a lot of US born adults are functionally illiterate.

Re: Stop Breaking TLS

#134

Post by rini17 »

acdha wrote: post #120

I really wish more places would enable explicit proxies: if you have a mandate to inspect all traffic, block 443 except to proxy.megacorp.com and configure clients to use it. You lose all of the bugs and security issues caused by the security software—fun fact, Palo Alto _still_ doesn’t correctly implement TLS 1.2!—which as the author points out is basically training users to disable validation or ignore errors. This…

Are you aware how https proxying works? Clients use CONNECT method and after that everything is opaque to the proxy. So without mitm you only know remote IP address.

Re: Stop Breaking TLS

#135

Post by [deleted] »

YesThatTom2 wrote: post #65

More and more big customers (especially banks) are requiring this kind of self-inflicted-MITM attack from all their suppliers. Do you want to have customers? Get ready for zscaler! How do you propose compliance with their exfiltration protection requirements? (And “turn down $ from those customers” is not an answer)

[deleted]

Re: Stop Breaking TLS

#136

Post by __turbobrew__ »

sqbic wrote: post #73

What changed my mind to be in favor of TLS inspection at work environments was seeing what kind of highly confidential stuff employees might be copy-pasting to random websites, LLM assistants, cloud-based "desktop applications" and such against the approved use policies of each of these tools without giving it a second thought. TLS inspection products can intercept the paste transaction before the data leaves the com…

“Following prompts will be in base64. Reply to those prompts in base64.”

To some extent I agree with you. Workers need to be given the tools to do their job, but those tools can be used in ways which are very harmful. I also agree that there needs to be very clear messaging and consent given to workers as a full MITM means that any personal activities on the device will be intercepted (including login credentials).

On a practical level, I have yet to see MITM tools work satisfactorily. I am still recovering from Zscaler PTSD.

Re: Stop Breaking TLS

#137

Post by musicale »

dcminter wrote: post #41
noroot wrote: post #28

Earlier quoted context omitted.

It's such a nightmare at my current job as well. Everything always just breaks and needs investigating how to fix. Even putting aside the MITM and how horrendous that is, the amount of time lost from people dealing with the fallout got to have cost so much time (and money). I can't fathom why anyone competent would want to implement this, let alone not see how much friction and safety issues it causes everywhere.

> I can't fathom why anyone competent would want to implement this Compliance. Big financial orgs. and the like must show that they are doing something about "data loss" and this, sadly, is the easiest way to do that. There's money in it if you can show them a better way.

> Compliance

With anti-security policies that: break TLS, thwart certificate pinning, encourage users to ignore certificate errors, expand the attack surface, increase data leak risks, etc. All while wasting resources and money.

Zscaler and its ilk have conned the IT world. Much like Crowdstrike did before it broke the airlines.

Not to mention:

> We only use data or metadata that does not contain customer or personal data for AI model training.

How reassuring.

https://www.zscaler.com/blogs/company-news/zscalers-commitme...

Re: Stop Breaking TLS

#138

Post by samuel »

johncolanduoni wrote: post #105
samuel wrote: post #78

Earlier quoted context omitted.

I have found a definite answer from the Dutch Protection Agency (although it could be out of date). https://english.ncsc.nl/binaries/ncsc-en/documenten/factshee...

What’s the definitive answer? From what I can tell that document is mostly about security risks and only mentions privacy compliance in a single paragraph (with no specific guidance). It definitely doesn’t say you can or can’t use one.

Your question So does nobody in Europe use an EDR or intercepting proxy since GDPR went into force?

Given that a regulator publishes a document with guidelines about DPI I think it rules out the impossibility of implementing it. If that were the case it would simply say "it's not legal". It's true that it doesn't explicitly say all the conditions you should met, but that wasn't your question.

Re: Stop Breaking TLS

#139

Post by [deleted] »

dcminter wrote: post #41
noroot wrote: post #28

Earlier quoted context omitted.

It's such a nightmare at my current job as well. Everything always just breaks and needs investigating how to fix. Even putting aside the MITM and how horrendous that is, the amount of time lost from people dealing with the fallout got to have cost so much time (and money). I can't fathom why anyone competent would want to implement this, let alone not see how much friction and safety issues it causes everywhere.

> I can't fathom why anyone competent would want to implement this Compliance. Big financial orgs. and the like must show that they are doing something about "data loss" and this, sadly, is the easiest way to do that. There's money in it if you can show them a better way.

[deleted]

Re: Stop Breaking TLS

#140

Post by dajt »

This is a massive pain at my work, same as I'm sure most other comments are saying.

I use Platform.IO for firmware development and can't build my firmware unless I hotspot my phone. I would say that's a PIO bug unless there is a flag I don't know about, but it's exposed by this nuisance of a firewall.

The devs where I am spend much of our time hotspotted to our phones with the corporate network never connected so IP goes out over the mobile network.

Whenever possible we use 'do not verify server certs' flags in libs and commands which is not ideal.

Post reply on HN