BlueCoat and other proxies hang up during TLS 1.3 • Hacker News Board

Re: BlueCoat and other proxies hang up during TLS 1.3

#201

Post by peterwwillis » Tue, Feb 28, 2017, 5:43 PM UTC

dvorak42 wrote: post #183

peterwwillis wrote: post #153

Earlier quoted context omitted.

The fix should not have been reversion. The fix should have been a simple workaround that if the connection fails totally and no downgrade handshake attempt was made, make a new connection using 1.2 to start with, which would succeed and the connection opened. This would be equivalent to a downgrade handshake from 1.3 to 1.2 but without requiring all products support 1.3.

The problem with this fix is that then as long as you have the fallback, the user gains none of the security properties of TLS 1.3 (since the attacker can always force a downgrade by sending junk to the client during the handshake) and has the additional cost of a second TLS negotiation. While there was previously this "TLS fallback" implemented in Chrome to work around buggy endpoints, this was primarily due to bugg…

Am I not correct that 1.3 got backed out of chrome for the current issue? So 1.3 isn't even there now... Which breaks anything that explicitly requires 1.3. My fix would support all cases and not break anything. Unless I missed something?

Re: BlueCoat and other proxies hang up during TLS 1.3

#202

Post by simias » Tue, Feb 28, 2017, 5:50 PM UTC

daxelrod wrote: post #200

simias wrote: post #158

Earlier quoted context omitted.

In my experience many companies simply filter based on port number. Run your external sshd/openvpn on port 80 and you're good to go. But of course that's going off topic since TFA is obviously about middleboxes actually intercepting and analyzing the traffic. In truth though if you start considering your employees like the enemy it's just a never ending upwards battle, especially if your employees are comp-sci folks.…

How does the threat model where employees are the enemy differ from the threat model where malware running inside the network is the enemy?

You want your employees to collaborate with you avoiding and tracking down malware and potential leaks. If everybody is used to working around your restrictions you just make it harder for you to figure out what's happening when something goes wrong.

For instance if your policies are too restrictive people will use their smartphones more and more to access the internet. Then some will start doing work stuff on their smartphones and you lose all control. What do you do then? Forbid smartphones within the company? Fire everybody you catch using one? It's just an arms race at this point.

Sane security measures and some pedagogy go a long way. Easier said than done though, it's a tough compromise to make.

Re: BlueCoat and other proxies hang up during TLS 1.3

#203

Post by daxelrod » Tue, Feb 28, 2017, 6:09 PM UTC

phkahler wrote: post #144

wildmusings wrote: post #22

Earlier quoted context omitted.

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer t…

>> If you're using your company's network, then they have every right to monitor all of the activity on it. I don't think so. Since when is it legal for anyone to circumvent encryption systems? Is it legal for your ISP to do this on "their network"? Actually, I bet you think that's OK too.

What law in the US makes it illegal to circumvent an encryption system? I can think of the DMCA's prohibitions against circumvention measures for DRM, but that's specific to protecting copyrighted works.

This FindLaw article http://employment.findlaw.com/workplace-privacy/privacy-in-t... agrees that employers have a right to monitor communications from their devices on their networks, especially when this policy has been clearly laid out and agreed to by employees. Expectation of privacy is a major deciding factor in US law.

I'm not sure of the legality of an ISP doing this. I would hope it's illegal, but ISPs are weirdly regulated compared to, say, phone companies.

Re: BlueCoat and other proxies hang up during TLS 1.3

#204

Post by peterwwillis » Tue, Feb 28, 2017, 6:16 PM UTC

theamk wrote: post #182

peterwwillis wrote: post #157

Earlier quoted context omitted.

Actually, no, that would just make everything more difficult. Browsers need to start coming to terms with the fact that they do not get do dictate how www networking operates for every organization around the world. There are hundreds of thousands of organizations that need inspection and caching and proxying of internal www traffic. That all protocols should disallow or frustrate this disregards real needs of users…

I disagree. We were living in the period of easy middleware (this was before HTTPS rollout), and it generally sucked -- there were supercookies, ads injection, general app breakage when you get a captive portal page instead of expected RPC response. The middleware should require effort to install, and it should be obvious when it is active. Otherwise, companies which have no business MITM'ing the traffic -- such as I…

And that's why the browser is at fault - they could have designed it to be more permissive or more secure, depending on the role. They decided instead on a one-size approach, once too permissive, now too restrictive.

As a regular user, I can't just use a captive portal to get free wifi, because any site I go to has HTTPS, so they all break and I can't accept the god damn HTTP accept page unless I can conjure up a valid domain that has no HTTPS like I'm Svengali. Now all the OSes have special checks to see if there's a captive portal because the browsers couldn't be troubled to build a function for it, even though it would improve their security and usability at the same time.

Captive portals are not the enemy. Shitty UX and a bad attitude toward the needs of real users is. Locking browsers/protocols down more is just doubling down on this mentality.

Re: BlueCoat and other proxies hang up during TLS 1.3

#205

Post by jessaustin » Tue, Feb 28, 2017, 6:30 PM UTC

daxelrod wrote: post #198

jessaustin wrote: post #154

Earlier quoted context omitted.

When I mentioned on a mailing list that we should probably pronounce this like "expect your personal bank info to be pwned" rather than "please don't use work resources for personal purposes", I was reminded that there are lots of perfectly reasonable work-related purposes that are undermined by TLS MitM. Corporate bank accounts, ACH transactions, payroll, vendor accounts, tax portals, employee benefits/401k, etc. Al…

How are any of the things you listed undermined by corporate MitM? Everything you listed is information that the company already has access to. Why isn't it sufficient for there to be access controls by policy, the same way the company protects other sensitive information from unauthorized acres within the company?

Keep up man! Upthread [0], reference was made to a study that's recently made the rounds detailing the basic insecurity of MitM devices. The problem isn't only that corporate network admins see everything, it's also that after the device downgrades TLS (or worse) attackers can also see what they want...

[0] https://news.ycombinator.com/item?id=13751715

Re: BlueCoat and other proxies hang up during TLS 1.3

#206

Post by jessaustin » Tue, Feb 28, 2017, 6:33 PM UTC

Elhana wrote: post #185

trome wrote: post #109

Earlier quoted context omitted.

Uhh, what do you do for sites that don't offer HTTP? Many sites force a 301 redirect when hit on HTTP, and won't downgrade.

Same thing I did when I noticed our bluecoat started mitm-ing my bank connection - ticket to IT to enable bypass for specific domain. They refused to do it for google/gmail, but banking sites start working normally on the next day. Youtube, facebook and other non work related stuff is just blocked, unless you need them to do your job (like PR dept).

Of course, for many people gmail would be a key to every door, via password resets.

Re: BlueCoat and other proxies hang up during TLS 1.3

#207

Post by kibwen » Tue, Feb 28, 2017, 6:40 PM UTC

peterwwillis wrote: post #187

kibwen wrote: post #181

Earlier quoted context omitted.

Then those organizations are free to not use encryption-friendly protocols for internal resources. Furthermore, those companies are free to fork Chromium or Firefox and distribute their own browser that renders these protocols toothless. IOW, it's completely fair to argue that users might not have a universal right to encryption, but it's just as legitimate to argue that browser vendors have no obligation to enable t…

No they aren't, encryption is still required for internal transactions as well as working with external partners. And fork a browser? Are you nuts? Nobody made that argument. But browser makers have an obligation to keep the world wide web usable. If it's not usable, say goodbye to dot com companies selling services to businesses, which aside from advertising revenue (and the hopes and dreams of venture capitalists)…

> No they aren't, encryption is still required for internal transactions as well as working with external partners.

Then continue to use the encryption that exists today. After all, your concern is for future standards that make encryption stronger.

> And fork a browser? Are you nuts?

A lone user forking a browser would be nuts. A company that's already willing to pay through the nose for MITM proxies can afford to fund a minor browser fork. Indeed, if this use case is as important as you suspect, then you ought to start a company that sells customized browsers for exactly this purpose. Think about what site you're on; where's your entrepreneurial spirit? :)

> But browser makers have an obligation to keep the world wide web usable.

Usable for whom? Between users (who need strong encryption), websites (who need strong encryption), and corporate intranets (who need to snoop), whose needs ought to be prioritized?

> abandon the web and start making proprietary native applications

The web emerged from a world where all applications were native and proprietary, I don't think any browser vendor is losing sleep over this possibility.

> Browsers just totally suck at interfacing with a dynamic user role.

Again, sounds like there's demand for a new browser then. :)

> nobody wants to make browsers easier to use (more the opposite)

Why is that?

Re: BlueCoat and other proxies hang up during TLS 1.3

#208

Post by deathanatos » Tue, Feb 28, 2017, 6:56 PM UTC

icebraining wrote: post #136

jarym wrote: post #108

Earlier quoted context omitted.

The Bluecoat sales people did a number on you huh? Sounds really good until you ask 'why doesn't Bluecoat understand this traffic' - because it really should.

TLS 1.3 is still quite new, doesn't seem outrageous that they take a bit to implement it.

This is a failure to implement any version of TLS correctly, not just v1.3. (TLS has support for version negotiation including receiving a hello from a client with a future version, such as v1.3.)

Re: BlueCoat and other proxies hang up during TLS 1.3

#209

Post by btbuilder » Tue, Feb 28, 2017, 7:13 PM UTC

NoGravitas wrote: post #162

btbuilder wrote: post #70

Earlier quoted context omitted.

All MITM proxies I know require an enterprise CA trusted by the end-point. If that CA is on your machine the endpoint is probably owned by your employer. It is legal in most jurisdictions for your employer to monitor the usage of resources they have provided, be it computer or network. I would never trust a company device, or company network, with anything I consider sensitive. Use your own device and keep it on cell…

Legal and ethical aren't the same thing, though. I agree it's legal for your employer to monitor traffic on their network. But an ethical sysadmin would not facilitate their doing so (unless there were a fairly significant and unusual justification in context). (Note: I would also never trust a company device or company network, and I keep my personal devices completely separate from the company network for this reas…

Personally I think that is too simplistic a position and the reality is more complex. Most people would agree that using this approach to spy on your employees to track their banking activity is unethical. Using MITM-SSL as a way to get visibility on certain APTs using products such as FireEye is controversial, but I don't personally believe to be unethical.

I would argue against such an approach if there are alternatives but if the organization's leaders were set on it I would engage with the process and make sure that it did not evolve into more unethical practices such as logging all traffic contents or the above banking example.

Re: BlueCoat and other proxies hang up during TLS 1.3

#210

Post by peterwwillis » Tue, Feb 28, 2017, 9:16 PM UTC

kibwen wrote: post #207

peterwwillis wrote: post #187

Earlier quoted context omitted.

No they aren't, encryption is still required for internal transactions as well as working with external partners. And fork a browser? Are you nuts? Nobody made that argument. But browser makers have an obligation to keep the world wide web usable. If it's not usable, say goodbye to dot com companies selling services to businesses, which aside from advertising revenue (and the hopes and dreams of venture capitalists)…

> No they aren't, encryption is still required for internal transactions as well as working with external partners. Then continue to use the encryption that exists today. After all, your concern is for future standards that make encryption stronger. > And fork a browser? Are you nuts? A lone user forking a browser would be nuts. A company that's already willing to pay through the nose for MITM proxies can afford to f…

There is no such thing as a minor browser fork. And my whole point was to not pick a side, it was to make the browser more flexible so it worked for more cases, not less.

Every non-Microsoft browser vendor used to cry themselves to sleep at night from days fighting against vendor lock-ins and corruption of standards. They certainly care if it all goes south.

I suppose people don't want easier browsers because they imagine they are easy enough and can't imagine something better. At least I hope that's the reason, and not that they fear change, or are indifferent to the needs of people other than themselves and prefer to design for that alone.

There's no way in hell I'm crazy enough to make a browser, though. I'd rather run for elected office, or eat an entire Volkswagen Golf.