BlueCoat and other proxies hang up during TLS 1.3

Post by mysticmarvel » Tue, Feb 28, 2017, 11:56 AM UTC

riffic wrote: post #59

wildmusings wrote: post #22

Earlier quoted context omitted.

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer t…

If you're using your company's network, then they have every right to monitor all of the activity on it. This is tantamount to steaming open and resealing the envelopes of all physical mail. Have some god damn ethics, I'd sooner quit than snoop traffic in this manner.

Post by avodonosov » Tue, Feb 28, 2017, 12:11 PM UTC

jeroenhd wrote: post #129

reacweb wrote: post #117

Earlier quoted context omitted.

Ssh is almost often available to connect through the firewall. Do IT people understand how easily you can work around proxy using ssh ? Just start a vm in the cloud (like a C1 at scaleway for 3.6€ per month), install squid (with default options). On your PC, run portable applications: putty connected to your vm with a forward of proxy port and portable firefox configured to use your forwarded proxy.

There's not even a need for installing a proxy! SSH has native SOCKS proxy support, so all you need to do is set up an SSH connection and set the browser connection to a dynamic SSH port forward. This also prevents leaking DNS requests : with a standard proxy your computer might be trying to look up domains using the company DNS system. With a SOCKS proxy, you can forward all DNS traffic as well!

Post by al2o3cr » Tue, Feb 28, 2017, 12:35 PM UTC

peterkelly wrote: post #133

From https://www.bluecoat.com/products-and-solutions/ssl-visibili... > "Enterprise class Blue Coat’s SSL Visibility Appliance is comprehensive, extensible solution that assures high-security encryption. While other vendors only support a handful of cipher-standards, the SSL Visibility Appliance provides timely and complete standards support, with over 70 cipher suites and key exchanges offered, and growing. Furthermo…

Post by jamespo » Tue, Feb 28, 2017, 12:41 PM UTC

semi-extrinsic wrote: post #130

cm2187 wrote: post #105

Earlier quoted context omitted.

Yeah. This is a firable offense. The solution to your company MITM your traffic is not to use your work computer for anything personal that matters. It's not like if we had a shortage of devices to connect to the internet.

If you live in a third-world country (or the US) which lacks basic functions of society like employee protection, a sensible minimum wage, universal healthcare, paid parental leave, etc., then yes, I don't recommend doing what my friend did with employing a little "civil disobedience" in such cases. TBH, for most techies I don't think opposition to MITM boxes comes down to "I don't want them to catch me looking at ca…

Post by dtornabene » Tue, Feb 28, 2017, 12:53 PM UTC

rasz_pl wrote: post #138

Blue Coat makes MitM/censoring devices, probably every wannabe shithole* with a dictator has it or competitors product installed. https://citizenlab.org/2013/01/planet-blue-coat-mapping-glob... *Egypt, Kuwait, Qatar, Saudi Arabia, the UAE. Afghanistan, Bahrain, China, India, Indonesia, Iraq, Kenya, Kuwait, Lebanon, Malaysia, Nigeria, Qatar, Russia, Saudi Arabia, South Korea, Singapore, Thailand, Turkey, and Venezuela…