Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueCoat and other proxies hang up during TLS 1.3

bugs.chromium.org

Post reply on HN
Print view View original

191–200 of 216 posts

Re: BlueCoat and other proxies hang up during TLS 1.3

#191

Post by semi-extrinsic »

Anderkent wrote: post #165
semi-extrinsic wrote: post #130

Earlier quoted context omitted.

If you live in a third-world country (or the US) which lacks basic functions of society like employee protection, a sensible minimum wage, universal healthcare, paid parental leave, etc., then yes, I don't recommend doing what my friend did with employing a little "civil disobedience" in such cases. TBH, for most techies I don't think opposition to MITM boxes comes down to "I don't want them to catch me looking at ca…

> Personally, I would find it unethical for the company I work for to buy these products. Then leave the company in protest or convince it not to buy them. DDoSing the company's network is somehow not unethical, I guess?

I agree talking to IT is step 1, and I'm assuming that hasn't worked.

Collective action (strikes, "work slowly protests" etc.) as a protest against company policy has a long precedent of a) being protected by law and b) being much more effective than a single employee quitting, while simultaneously reducing the downside for employees (in L_\infty norm).

Edit: the old Keynes quote comes to mind: "if you owe the bank $100 you have a problem, but if you owe the bank $100 million the bank has a problem" -- if 1 of the company's devs commits a "fireable offense", he/she has a problem, but if 100 of them do, the company has a problem.

Re: BlueCoat and other proxies hang up during TLS 1.3

#192

Post by Cuuugi »

jessaustin wrote: post #159
dtornabene wrote: post #149

Earlier quoted context omitted.

Yeah, this is totally not racist in any way. Good to know all the brown people live in "shitholes". Hard to know if this trolling or just casual racism.

You're reading something that isn't there. Russians are like the whitest people on earth. South Korea and Singapore aren't "shitholes" by any measure. However, by their BlueCoat use, they are "wannabe shitholes". I clicked through to find you are "antifa". Didn't you get the memo? You can't be seen to defend Russia in any way!

Anti First Amendment. They don't like being questioned.

Re: BlueCoat and other proxies hang up during TLS 1.3

#193

Post by kretor »

dtornabene wrote: post #160
jessaustin wrote: post #159

Earlier quoted context omitted.

You're reading something that isn't there. Russians are like the whitest people on earth. South Korea and Singapore aren't "shitholes" by any measure. However, by their BlueCoat use, they are "wannabe shitholes". I clicked through to find you are "antifa". Didn't you get the memo? You can't be seen to defend Russia in any way!

While russians are, yeah, pretty white, that still reads as pretty racist. wannabe shitholes is....kinda not a good look. just sayin. EDIT: also worth pointing out, Russia is literally the only country listed that has a "white" population. So, yeah, downvote all ya'll want, that was a racist( or trolling) comment. you're totally right on that last point though. ;)

The list of countries seems to be coming from the blogpost the commenter linked: https://citizenlab.org/2013/01/planet-blue-coat-mapping-glob...

Re: BlueCoat and other proxies hang up during TLS 1.3

#194

Post by compuguy »

cm2187 wrote: post #105
semi-extrinsic wrote: post #85

Earlier quoted context omitted.

There was a paper posted on HN a few weeks back by some pretty serious security researchers on the security risks of SSL MITM boxes. https://jhalderm.com/pub/papers/interception-ndss17.pdf How do you fix this when you're naught but a humble employee? Well, a friend of mine worked at a fairly large tech company where a salesguy for these boxes had convinced the CTO they had to have them. Every tech-person "on the floo…

Yeah. This is a firable offense. The solution to your company MITM your traffic is not to use your work computer for anything personal that matters. It's not like if we had a shortage of devices to connect to the internet.

Criminal possibly as well, possibly under the CFAA.

not a lawyer.

Re: BlueCoat and other proxies hang up during TLS 1.3

#195

Post by mbrumlow »

reacweb wrote: post #117
rossy wrote: post #36

Earlier quoted context omitted.

BlueCoat makes me cry. We have an application running inside the firewall of one of our clients that communicates with a HTTPS REST API hosted by a server in our datacenter. The connection must be encrypted because it handles confidential information, but when it passes through BlueCoat's TLS proxy, the Authorization header gets mangled and it can't authenticate against our backend. Higher-ups decided that it would b…

Ssh is almost often available to connect through the firewall. Do IT people understand how easily you can work around proxy using ssh ? Just start a vm in the cloud (like a C1 at scaleway for 3.6€ per month), install squid (with default options). On your PC, run portable applications: putty connected to your vm with a forward of proxy port and portable firefox configured to use your forwarded proxy.

The problem is middleboxes like fortigate also do MITM on ssh connections. Assuming you are not bringing home devices into work and don't have your ssh server's fingerprint memorized you might be tempted to just type 'yes' when prompted.

In any case you are left with no SSH, or somebody watching your ssh and have control over your ability to tunnel.

The best you can do with these boxes is make a sub tunnel over one of the protocols that they do allow through, you just can't rely on the primary encryption provided by the protocol that the middle box is executing MITM on. If somebody actually looks at the traffic they will see that you are not transferring plain text at the middle box, so that might raise some eyebrows.

Re: BlueCoat and other proxies hang up during TLS 1.3

#196

Post by jeroenhd »

shthed wrote: post #155

I wish Chrome wouldn't show a site as 'Secure' if it can tell that the connection is being MITM'd

This is a good point. Google has added functionality so that user installed certificates bypass all certificate pinning utilities, so users using these tools are less protected. However, there is no indication of the network being monitored once the certificate has been installed.

On Android every time a user-installed certificate authority is used a warning is shown. Furthermore, the user is forced to set a lock screen the moment you install a certificate.

If Google can push this (frankly user unfriendly) UI through, why not change "Secure" into "Monitored" in Google Chrome? The green padlock is a lie and the truth is exposed only after inspecting the certificate using the web developer tools.

Re: BlueCoat and other proxies hang up during TLS 1.3

#197

Post by fulafel »

akx wrote: post #113
fulafel wrote: post #48

Earlier quoted context omitted.

Of course they have a choice. It's not very princinpled to sell your children's online privacy in exchange for some "grant" money going to an oppressive-dictatorship supporting company like BlueCoat. (Also it's possible can do server address based blocking without MITM)

Sure, it's possible, if you're willing to blanket block all sorts of elastic IP ranges such as all of AWS.

You can do it based on DNS.

Re: BlueCoat and other proxies hang up during TLS 1.3

#198

Post by daxelrod »

jessaustin wrote: post #154
cm2187 wrote: post #105

Earlier quoted context omitted.

Yeah. This is a firable offense. The solution to your company MITM your traffic is not to use your work computer for anything personal that matters. It's not like if we had a shortage of devices to connect to the internet.

When I mentioned on a mailing list that we should probably pronounce this like "expect your personal bank info to be pwned" rather than "please don't use work resources for personal purposes", I was reminded that there are lots of perfectly reasonable work-related purposes that are undermined by TLS MitM. Corporate bank accounts, ACH transactions, payroll, vendor accounts, tax portals, employee benefits/401k, etc. Al…

How are any of the things you listed undermined by corporate MitM?

Everything you listed is information that the company already has access to. Why isn't it sufficient for there to be access controls by policy, the same way the company protects other sensitive information from unauthorized acres within the company?

Re: BlueCoat and other proxies hang up during TLS 1.3

#199

Post by raesene6 »

semi-extrinsic wrote: post #191
Anderkent wrote: post #165

Earlier quoted context omitted.

> Personally, I would find it unethical for the company I work for to buy these products. Then leave the company in protest or convince it not to buy them. DDoSing the company's network is somehow not unethical, I guess?

I agree talking to IT is step 1, and I'm assuming that hasn't worked. Collective action (strikes, "work slowly protests" etc.) as a protest against company policy has a long precedent of a) being protected by law and b) being much more effective than a single employee quitting, while simultaneously reducing the downside for employees (in L_\infty norm). Edit: the old Keynes quote comes to mind: "if you owe the bank $…

However with collective action, the company is usually aware of their employees actions, here if I'm reading correctly management were not notified that this was happening, so perhaps not quote the same thing.

Re: BlueCoat and other proxies hang up during TLS 1.3

#200

Post by daxelrod »

simias wrote: post #158
jamespo wrote: post #148

Earlier quoted context omitted.

Why would anyone competent allow unrestricted ssh through the corporate firewall?

In my experience many companies simply filter based on port number. Run your external sshd/openvpn on port 80 and you're good to go. But of course that's going off topic since TFA is obviously about middleboxes actually intercepting and analyzing the traffic. In truth though if you start considering your employees like the enemy it's just a never ending upwards battle, especially if your employees are comp-sci folks.…

How does the threat model where employees are the enemy differ from the threat model where malware running inside the network is the enemy?
Post reply on HN