Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueCoat and other proxies hang up during TLS 1.3

bugs.chromium.org

Post reply on HN
Print view View original

181–190 of 216 posts

Re: BlueCoat and other proxies hang up during TLS 1.3

#181

Post by kibwen »

peterwwillis wrote: post #157
quotemstr wrote: post #4

Earlier quoted context omitted.

Ridiculously conservative middleboxes are why we can't have nice things and why we need to encrypt all new protocols, security properties aside.

Actually, no, that would just make everything more difficult. Browsers need to start coming to terms with the fact that they do not get do dictate how www networking operates for every organization around the world. There are hundreds of thousands of organizations that need inspection and caching and proxying of internal www traffic. That all protocols should disallow or frustrate this disregards real needs of users…

Then those organizations are free to not use encryption-friendly protocols for internal resources. Furthermore, those companies are free to fork Chromium or Firefox and distribute their own browser that renders these protocols toothless.

IOW, it's completely fair to argue that users might not have a universal right to encryption, but it's just as legitimate to argue that browser vendors have no obligation to enable the trivial circumvention of encryption. If the software doesn't work for your needs, then stop using the software.

Re: BlueCoat and other proxies hang up during TLS 1.3

#182

Post by theamk »

peterwwillis wrote: post #157
quotemstr wrote: post #4

Earlier quoted context omitted.

Ridiculously conservative middleboxes are why we can't have nice things and why we need to encrypt all new protocols, security properties aside.

Actually, no, that would just make everything more difficult. Browsers need to start coming to terms with the fact that they do not get do dictate how www networking operates for every organization around the world. There are hundreds of thousands of organizations that need inspection and caching and proxying of internal www traffic. That all protocols should disallow or frustrate this disregards real needs of users…

I disagree. We were living in the period of easy middleware (this was before HTTPS rollout), and it generally sucked -- there were supercookies, ads injection, general app breakage when you get a captive portal page instead of expected RPC response.

The middleware should require effort to install, and it should be obvious when it is active. Otherwise, companies which have no business MITM'ing the traffic -- such as ISPs and free wifi providers -- will start to do it just because it's so simple.

For example, Google may require MDM app on the Android devices which is used to access corporate data. This app ensures that the device has the right policy (screen lock, encryption) and I think it may also check for malware apps. This is how it should be -- if you need corporate control over devices, install special application on it, it will be more efficient and it will do more.

Re: BlueCoat and other proxies hang up during TLS 1.3

#183

Post by dvorak42 »

peterwwillis wrote: post #153
JoshTriplett wrote: post #2

Note that this happens even when using a BlueCoat proxy in non-MITM mode. BlueCoat tries to "analyze" TLS connections, and rejects anything it doesn't understand. This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0. In this case, it doesn't sound like they're reverting it because of overall breakage, but rather because it breaks the tool that would otherwise be used to control TLS 1.3 tr…

The fix should not have been reversion. The fix should have been a simple workaround that if the connection fails totally and no downgrade handshake attempt was made, make a new connection using 1.2 to start with, which would succeed and the connection opened. This would be equivalent to a downgrade handshake from 1.3 to 1.2 but without requiring all products support 1.3.

The problem with this fix is that then as long as you have the fallback, the user gains none of the security properties of TLS 1.3 (since the attacker can always force a downgrade by sending junk to the client during the handshake) and has the additional cost of a second TLS negotiation.

While there was previously this "TLS fallback" implemented in Chrome to work around buggy endpoints, this was primarily due to buggy endpoints* which was a much larger issue and difficult to fix, while these middlebox issues affect a much smaller portion of users and we're hopeful that the middlebox vendors that have issues can fix their software in a more timely manner.

* TLS 1.3 moves the version negotiation into an extension, which means that old buggy servers will only ever know about TLS 1.2 and below for negotiation purposes and won't break in a new matter with TLS 1.3.

Re: BlueCoat and other proxies hang up during TLS 1.3

#184

Post by jacquesm »

AlyssaRowan wrote: post #167
lmm wrote: post #132

Earlier quoted context omitted.

What's true is true - better to know it than stick our heads in the sand. If these boxes have vulnerabilities (who am I kidding, they do parsing, they're probably implemented in C "for performance", of course they have vulnerabilities), we are better off for knowing about them than not.

But what of the equities issue - what to do with that knowledge, once discovered? Might it depend on who "we" are? My point is that actually helping this particular vendor, for example, may not be everyone's cup of tea.

Yes, good point. One might aim to 'help' them into an early grave whilst actually helping them to strengthen their product.

Re: BlueCoat and other proxies hang up during TLS 1.3

#185

Post by Elhana »

trome wrote: post #109
adrianN wrote: post #103

Earlier quoted context omitted.

It might backfire and your company forbids HTTPS "so that employees can't disclose company secrets without IT having traceability".

Uhh, what do you do for sites that don't offer HTTP? Many sites force a 301 redirect when hit on HTTP, and won't downgrade.

Same thing I did when I noticed our bluecoat started mitm-ing my bank connection - ticket to IT to enable bypass for specific domain. They refused to do it for google/gmail, but banking sites start working normally on the next day. Youtube, facebook and other non work related stuff is just blocked, unless you need them to do your job (like PR dept).

Re: BlueCoat and other proxies hang up during TLS 1.3

#186

Post by jandrese »

JoshTriplett wrote: post #2

Note that this happens even when using a BlueCoat proxy in non-MITM mode. BlueCoat tries to "analyze" TLS connections, and rejects anything it doesn't understand. This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0. In this case, it doesn't sound like they're reverting it because of overall breakage, but rather because it breaks the tool that would otherwise be used to control TLS 1.3 tr…

Sometimes it is even worse than that. Some of the middleware TLS proxies don't verify the certificate before they resign the data. They completely open up your enterprise to MITM attacks, and in fact hide the fact that you are being MITMed. This came to light way back during the Superfish debacle, and some vendors still have not fixed the problem.

Re: BlueCoat and other proxies hang up during TLS 1.3

#187

Post by peterwwillis »

kibwen wrote: post #181
peterwwillis wrote: post #157

Earlier quoted context omitted.

Actually, no, that would just make everything more difficult. Browsers need to start coming to terms with the fact that they do not get do dictate how www networking operates for every organization around the world. There are hundreds of thousands of organizations that need inspection and caching and proxying of internal www traffic. That all protocols should disallow or frustrate this disregards real needs of users…

Then those organizations are free to not use encryption-friendly protocols for internal resources. Furthermore, those companies are free to fork Chromium or Firefox and distribute their own browser that renders these protocols toothless. IOW, it's completely fair to argue that users might not have a universal right to encryption, but it's just as legitimate to argue that browser vendors have no obligation to enable t…

No they aren't, encryption is still required for internal transactions as well as working with external partners. And fork a browser? Are you nuts?

Nobody made that argument. But browser makers have an obligation to keep the world wide web usable. If it's not usable, say goodbye to dot com companies selling services to businesses, which aside from advertising revenue (and the hopes and dreams of venture capitalists) is the only way they survive.

The only reasonable alternative if you start locking out legitimate business use cases of traffic inspection is to abandon the web and start making proprietary native applications and protocols like back in the old days. This is bad for users and bad for business.

It's not like it's even hard to support these use cases while maintaining user security! Browsers just totally suck at interfacing with a dynamic user role. Better UX and a more flexible protocol would solve this, but nobody wants to make browsers easier to use (more the opposite)

Re: BlueCoat and other proxies hang up during TLS 1.3

#188

Post by dang »

rasz_pl wrote: post #138

Blue Coat makes MitM/censoring devices, probably every wannabe shithole* with a dictator has it or competitors product installed. https://citizenlab.org/2013/01/planet-blue-coat-mapping-glob... *Egypt, Kuwait, Qatar, Saudi Arabia, the UAE. Afghanistan, Bahrain, China, India, Indonesia, Iraq, Kenya, Kuwait, Lebanon, Malaysia, Nigeria, Qatar, Russia, Saudi Arabia, South Korea, Singapore, Thailand, Turkey, and Venezuela…

We've banned this account. National slurs are not welcome here. Also, you've posted many uncivil and/or unsubstantive comments. That makes this site worse and is not allowed (and we warned you repeatedly).

We detached this subthread from https://news.ycombinator.com/item?id=13750516 and marked it off-topic.

Re: BlueCoat and other proxies hang up during TLS 1.3

#189

Post by dang »

dom0 wrote: post #169
jessaustin wrote: post #159

Earlier quoted context omitted.

You're reading something that isn't there. Russians are like the whitest people on earth. South Korea and Singapore aren't "shitholes" by any measure. However, by their BlueCoat use, they are "wannabe shitholes". I clicked through to find you are "antifa". Didn't you get the memo? You can't be seen to defend Russia in any way!

> I clicked through to find you are "antifa". Didn't you get the memo? Oh please, most of these people never used their brains to think. At least, that's my personal experience with them.

Please don't make a bad thread worse.

Re: BlueCoat and other proxies hang up during TLS 1.3

#190

Post by dang »

riffic wrote: post #135
dang wrote: post #107

Edit: oops, my mistake. Carry on. > Have some god damn ethics Personal attacks are not allowed on HN. We ban accounts that do this, so please don't do it. We detached this subthread from https://news.ycombinator.com/item?id=13750650 and marked it off-topic.

This was not intended to be read as a personal attack, sorry about that. My intention was a (perhaps poorly worded) call on those in the industry to have a sense of ethics, and not meant to single any person in particular.

Sorry for misreading you! I've put your comment back and detached this bit instead.
Post reply on HN