Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueCoat and other proxies hang up during TLS 1.3

bugs.chromium.org

Post reply on HN
Print view View original

151–160 of 216 posts

Re: BlueCoat and other proxies hang up during TLS 1.3

#151

Post by the8472 »

xfs wrote: post #40

The title was editorialized. TLS 1.3 is a working draft and Chromium is just doing field trial with it. A few days ago there were other issues with this causing Chromium to stop working on *.google.com so it's not just about middle-boxes. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=855434 https://bugs.chromium.org/p/chromium/issues/detail?id=693943

TLS1.3 may be a working draft, correctly implementing TLS version negotiation on the other hand is not as it already is a requirement of previous versions.

Re: BlueCoat and other proxies hang up during TLS 1.3

#152

Post by skywhopper »

coderobe wrote: post #3
JoshTriplett wrote: post #2

Note that this happens even when using a BlueCoat proxy in non-MITM mode. BlueCoat tries to "analyze" TLS connections, and rejects anything it doesn't understand. This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0. In this case, it doesn't sound like they're reverting it because of overall breakage, but rather because it breaks the tool that would otherwise be used to control TLS 1.3 tr…

Rejecting anything it doesn't understand sounds like a bug to me. If it sees that it's TLS, it should attempt a protocol downgrade. There's absolutely no reason for this to break, as TLS 1.3 exists alongside TLS 1.2 (For now).

It's in BlueCoat's political interests to make sure TLS 1.3 rolls out as slowly as possible since it actively works against their entire business model, so they have zero incentive to be proactive about this until the TLS 1.3 extensions are approved that make MITM possible again.

Re: BlueCoat and other proxies hang up during TLS 1.3

#153

Post by peterwwillis »

JoshTriplett wrote: post #2

Note that this happens even when using a BlueCoat proxy in non-MITM mode. BlueCoat tries to "analyze" TLS connections, and rejects anything it doesn't understand. This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0. In this case, it doesn't sound like they're reverting it because of overall breakage, but rather because it breaks the tool that would otherwise be used to control TLS 1.3 tr…

The fix should not have been reversion. The fix should have been a simple workaround that if the connection fails totally and no downgrade handshake attempt was made, make a new connection using 1.2 to start with, which would succeed and the connection opened. This would be equivalent to a downgrade handshake from 1.3 to 1.2 but without requiring all products support 1.3.

Re: BlueCoat and other proxies hang up during TLS 1.3

#154

Post by jessaustin »

cm2187 wrote: post #105
semi-extrinsic wrote: post #85

Earlier quoted context omitted.

There was a paper posted on HN a few weeks back by some pretty serious security researchers on the security risks of SSL MITM boxes. https://jhalderm.com/pub/papers/interception-ndss17.pdf How do you fix this when you're naught but a humble employee? Well, a friend of mine worked at a fairly large tech company where a salesguy for these boxes had convinced the CTO they had to have them. Every tech-person "on the floo…

Yeah. This is a firable offense. The solution to your company MITM your traffic is not to use your work computer for anything personal that matters. It's not like if we had a shortage of devices to connect to the internet.

When I mentioned on a mailing list that we should probably pronounce this like "expect your personal bank info to be pwned" rather than "please don't use work resources for personal purposes", I was reminded that there are lots of perfectly reasonable work-related purposes that are undermined by TLS MitM. Corporate bank accounts, ACH transactions, payroll, vendor accounts, tax portals, employee benefits/401k, etc. All of that stuff should actually be secure.

Incidentally, "Blue Coat ProxySG 6642" was the only middlebox to get an "A" from the study referenced above. Apparently they didn't test for 1.3...

Re: BlueCoat and other proxies hang up during TLS 1.3

#156

Post by discreditable »

pluma wrote: post #118
bgc wrote: post #30

Earlier quoted context omitted.

The Board doesn't have a choice, under CIPA[0], content filtering is a requirement for the FCC's E-Rate program[1] in which the government pays some of the cost of the school's internet connection. [0] https://www.fcc.gov/consumers/guides/childrens-internet-prot... [1] https://www.fcc.gov/general/universal-service-program-school...

Seems like some people disagree with this interpretation: https://twitter.com/N805DN/status/835945815227138048 AIUI CIPA doesn't require MITM but most schools interpret it that way.

Most (private) schools in my area do not interpret it to require MITM. We specifically want to avoid MITM because it's a can of worms we don't want opened. We rely instead on SNI-based filtering systems, which work well for the most part. I'm using TLS 1.3 in Firefox Nightly with no issues.

Re: BlueCoat and other proxies hang up during TLS 1.3

#157

Post by peterwwillis »

quotemstr wrote: post #4
JoshTriplett wrote: post #2

Note that this happens even when using a BlueCoat proxy in non-MITM mode. BlueCoat tries to "analyze" TLS connections, and rejects anything it doesn't understand. This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0. In this case, it doesn't sound like they're reverting it because of overall breakage, but rather because it breaks the tool that would otherwise be used to control TLS 1.3 tr…

Ridiculously conservative middleboxes are why we can't have nice things and why we need to encrypt all new protocols, security properties aside.

Actually, no, that would just make everything more difficult. Browsers need to start coming to terms with the fact that they do not get do dictate how www networking operates for every organization around the world.

There are hundreds of thousands of organizations that need inspection and caching and proxying of internal www traffic. That all protocols should disallow or frustrate this disregards real needs of users and organizations.

Further still, if protocols can't be designed to be implemented easily or to allow for implementation bugs or lack of features, it's a crap protocol or application. Middleware will always be necessary, and encryption really shouldn't change the requirements of how middleware needs to work with a protocol.

Re: BlueCoat and other proxies hang up during TLS 1.3

#158

Post by simias »

jamespo wrote: post #148
reacweb wrote: post #117

Earlier quoted context omitted.

Ssh is almost often available to connect through the firewall. Do IT people understand how easily you can work around proxy using ssh ? Just start a vm in the cloud (like a C1 at scaleway for 3.6€ per month), install squid (with default options). On your PC, run portable applications: putty connected to your vm with a forward of proxy port and portable firefox configured to use your forwarded proxy.

Why would anyone competent allow unrestricted ssh through the corporate firewall?

In my experience many companies simply filter based on port number. Run your external sshd/openvpn on port 80 and you're good to go. But of course that's going off topic since TFA is obviously about middleboxes actually intercepting and analyzing the traffic.

In truth though if you start considering your employees like the enemy it's just a never ending upwards battle, especially if your employees are comp-sci folks. You could tunnel SSH over HTTP or even DNS if you cared enough.

Re: BlueCoat and other proxies hang up during TLS 1.3

#159

Post by jessaustin »

dtornabene wrote: post #149
rasz_pl wrote: post #138

Blue Coat makes MitM/censoring devices, probably every wannabe shithole* with a dictator has it or competitors product installed. https://citizenlab.org/2013/01/planet-blue-coat-mapping-glob... *Egypt, Kuwait, Qatar, Saudi Arabia, the UAE. Afghanistan, Bahrain, China, India, Indonesia, Iraq, Kenya, Kuwait, Lebanon, Malaysia, Nigeria, Qatar, Russia, Saudi Arabia, South Korea, Singapore, Thailand, Turkey, and Venezuela…

Yeah, this is totally not racist in any way. Good to know all the brown people live in "shitholes". Hard to know if this trolling or just casual racism.

You're reading something that isn't there. Russians are like the whitest people on earth. South Korea and Singapore aren't "shitholes" by any measure. However, by their BlueCoat use, they are "wannabe shitholes".

I clicked through to find you are "antifa". Didn't you get the memo? You can't be seen to defend Russia in any way!

Re: BlueCoat and other proxies hang up during TLS 1.3

#160

Post by dtornabene »

jessaustin wrote: post #159
dtornabene wrote: post #149

Earlier quoted context omitted.

Yeah, this is totally not racist in any way. Good to know all the brown people live in "shitholes". Hard to know if this trolling or just casual racism.

You're reading something that isn't there. Russians are like the whitest people on earth. South Korea and Singapore aren't "shitholes" by any measure. However, by their BlueCoat use, they are "wannabe shitholes". I clicked through to find you are "antifa". Didn't you get the memo? You can't be seen to defend Russia in any way!

While russians are, yeah, pretty white, that still reads as pretty racist. wannabe shitholes is....kinda not a good look. just sayin.

EDIT: also worth pointing out, Russia is literally the only country listed that has a "white" population. So, yeah, downvote all ya'll want, that was a racist( or trolling) comment.

you're totally right on that last point though. ;)

Post reply on HN