Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueCoat and other proxies hang up during TLS 1.3

bugs.chromium.org

Post reply on HN
Print view View original

171–180 of 216 posts

Re: BlueCoat and other proxies hang up during TLS 1.3

#171

Post by acdha »

habitue wrote: post #80
acdha wrote: post #28

Earlier quoted context omitted.

Think about how that conversation would go. They're driven by concerns that kids will look at porn – and remember that if they don't try to stop that, the local Fox News applicate will be running a loop 24x7 saying they're trying to force godly children to watch it – or that someone will breach a staff member's computer and steal PII, compromise the security cameras, etc. Against that, making life hard for Chrome eng…

Just an FYI, local fox affiliates don't have the ideological bent of the cable station. They're often run by entirely different companies

True. In the areas where I've lived they were reliably the most breathless of local TV news cycle but that's a limited sample size.

Re: BlueCoat and other proxies hang up during TLS 1.3

#172

Post by wolf550e »

throw2016 wrote: post #170

There is a massive hypocrisy in browser vendors getting hysterical about self signed certs while letting MITM proxies operate with impunity or worse working with them. Why isn't there an effort to detect MITM proxies and post equally scary warnings? Surely users have a right to know. MITM is worse than self signed certs and if 'exceptions' can be found for MITM like corporate security, management etc then the same ex…

Why do you prefer a self signed certificate instead of using let's encrypt?

You can create a self signed CA and add it to trusted roots to avoid warnings.

Re: BlueCoat and other proxies hang up during TLS 1.3

#173

Post by acdha »

jamespo wrote: post #148
reacweb wrote: post #117

Earlier quoted context omitted.

Ssh is almost often available to connect through the firewall. Do IT people understand how easily you can work around proxy using ssh ? Just start a vm in the cloud (like a C1 at scaleway for 3.6€ per month), install squid (with default options). On your PC, run portable applications: putty connected to your vm with a forward of proxy port and portable firefox configured to use your forwarded proxy.

Why would anyone competent allow unrestricted ssh through the corporate firewall?

Ask what goal they're trying to solve: is it really because the IT people want to monitor everyone's web surfing or do they have something like an audit requirement? There are a LOT of people in the latter camp who need to check the box to say they comply with some policy, regulation, etc.

Similarly, good security people know that port filtering is a losing game unless you are willing to restrict everything to a known-safe whitelist – the malware authors do work full-time on tunneling techniques, after all – and may be focusing their efforts on endpoint protection or better isolation between users/groups.

Re: BlueCoat and other proxies hang up during TLS 1.3

#174

Post by 794CD01 »

skywhopper wrote: post #150
jessaustin wrote: post #8

Earlier quoted context omitted.

This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0. Good grief! From David Benjamin's final comment: Note these issues are always bugs in the middlebox products. TLS version negotiation is backwards compatible, so a correctly-implemented TLS-terminating proxy should not require changes to work in a TLS-1.3-capable ecosystem. It can simply speak TLS 1.2 at both client proxy and proxy ser…

The entire use case of BlueCoat and the like is to satisfy executives' desire to spy on all usage of their network. It's certainly not to benefit the users who are stuck behind it, to increase their security, or to give them a better Internet experience.

Fuck the users. If users had their way, they'd have all the local administrator privileges they wanted so that they could download malware to their heart's content. From a non-IT perspective, they would also be free to download porn, potentially child porn, which is a crime to merely possess, and exfiltrate terabytes of company secrets.

Re: BlueCoat and other proxies hang up during TLS 1.3

#176

Post by throw2016 »

wolf550e wrote: post #172
throw2016 wrote: post #170

There is a massive hypocrisy in browser vendors getting hysterical about self signed certs while letting MITM proxies operate with impunity or worse working with them. Why isn't there an effort to detect MITM proxies and post equally scary warnings? Surely users have a right to know. MITM is worse than self signed certs and if 'exceptions' can be found for MITM like corporate security, management etc then the same ex…

Why do you prefer a self signed certificate instead of using let's encrypt? You can create a self signed CA and add it to trusted roots to avoid warnings.

Because it does not rely on any 'authority'. The increasingly scary warnings by browser vendors is in stark contrast to zero interest in detecting MITMs and warning users. The next step could very well be the disabling the ability to add exceptions for self signed certs.

Why not promote content encryption or explore other ideas that do not rely on central authorities, and we can see there are always workaround for corporates but individuals are thrown under the bus.

Re: BlueCoat and other proxies hang up during TLS 1.3

#177

Post by dorfsmay »

Browsers should add a button which allow being proxied, combined with a campaign to educate people on the difference.

I think its reasonable for a company to want to filter everything that comes through their pipe, if anything, it's a bit of a liability not to do it, but at the same time, non-technical people should understand that their connection is being unencrypted and re-encrypted, and be educated on the consequences.

There are a few local coffee shops which terminate SSL, and when people see me closing my browser and laptop, or starting to tether through my phone because of the cert error they tell me "oh, you just need to accept all those certs!".

Re: BlueCoat and other proxies hang up during TLS 1.3

#180

Post by feld »

cm2187 wrote: post #105
semi-extrinsic wrote: post #85

Earlier quoted context omitted.

There was a paper posted on HN a few weeks back by some pretty serious security researchers on the security risks of SSL MITM boxes. https://jhalderm.com/pub/papers/interception-ndss17.pdf How do you fix this when you're naught but a humble employee? Well, a friend of mine worked at a fairly large tech company where a salesguy for these boxes had convinced the CTO they had to have them. Every tech-person "on the floo…

Yeah. This is a firable offense. The solution to your company MITM your traffic is not to use your work computer for anything personal that matters. It's not like if we had a shortage of devices to connect to the internet.

My day job includes working on FreeBSD systems and also doing open source FreeBSD work (push upstream, pull down to us). There are sometimes embargoed security notices in my email. There is no chance I will permit my employer to MITM my SSL and risk some clowns in corporate IT from obtaining these mails. (highest security ones are GPG encrypted, but others are not)

I need my personal email to do my work. It needs to stay secure from even my own employer. Period.

Post reply on HN