Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Breaking TLS

markround.com

Post reply on HN
Print view View original

41–50 of 175 posts

Re: Stop Breaking TLS

#41

Post by dcminter »

noroot wrote: post #28
gschizas wrote: post #11

The fact that most tools have completely different ways to allow them to add certificates is the biggest pain. Git, Python and Rust also have large issues. Git doesn't default to "http.schannel". Python (or rather requests, or maybe urllib3) only looks at its own certificate store, and I have no idea how Rust does this (well, I use uv, and it has its own problems - I know about the --use-native-tls flag, but it shoul…

It's such a nightmare at my current job as well. Everything always just breaks and needs investigating how to fix. Even putting aside the MITM and how horrendous that is, the amount of time lost from people dealing with the fallout got to have cost so much time (and money). I can't fathom why anyone competent would want to implement this, let alone not see how much friction and safety issues it causes everywhere.

> I can't fathom why anyone competent would want to implement this

Compliance. Big financial orgs. and the like must show that they are doing something about "data loss" and this, sadly, is the easiest way to do that.

There's money in it if you can show them a better way.

Re: Stop Breaking TLS

#42

Post by kreetx »

phito wrote: post #30
arianvanp wrote: post #18

Complains about TLS inspection, yet fronts their website on the biggest and most widely deployed TLS introspection middle box in the world ... Why do we all disdain local TLS inspection software yet half the Internet terminates their TLS connection at Cloudflare who are most likely giving direct access to US Intelligence? It's so much worse as it's infringing on the privacy and security of billions of innocent people…

I wish so too, same for all the self-hosters using tailscale...

These are not the same thing, the parent is confused..

Re: Stop Breaking TLS

#43

Post by kreetx »

The title should say "Stop inspecting TLS", the current title reads like the TLS standard or technology is modified in a way to not work properly.

Re: Stop Breaking TLS

#44

Post by voidUpdate »

I'm hoping this doesn't apply to things like Fiddler, because without the ability to see what's actually coming over the wire with a https connection, things can be a nightmare to debug sometimes

Re: Stop Breaking TLS

#45

Post by dcminter »

Daviey wrote: post #12

Honestly, the author is spot on about the normalisation problem. I've watched this play out at multiple organisations. You implement TLS inspection, spend ages getting certs deployed, and within six months `curl -k` is in half your runbooks because "it's just the corporate proxy again". He's also absolutely right about the architectural problems too, single points of failure, performance bottlenecks, and the complexi…

Hallelujah!

But I have to say, big regulated orgs are often not competent to do things this (the right) way but don't have the option of not doing it at all.

Re: Stop Breaking TLS

#46

Post by redrix »

nly wrote: post #27

"If you use my (private) network you follow my rules" And I find it hard to argue with that. I've been using a VPN habitually on my phone and my (personal) laptop for a decade now. Work, home, travel. Doesn't matter. It's always on.

How do you find your typical daily battery life with it always on?

I’ve tried this in the past and had to revert as I found it made a noticeable difference in my day-to-day.

Curious to hear the experience of others.

Re: Stop Breaking TLS

#47

Post by itopaloglu83 »

samuel wrote: post #10

I agree with the sentiment, but I think it's a pretty naive view of the issue. Companies will want all info they can in case some of their workers does something illegal-inappropiate to deflect the blame. That's a much more palpable risk than "local CA certificates being compromised or something like that. And some of the arguments are just very easily dismissed. You don't want your employer to see you medical record…

I’m all for privacy of individuals, but work network is not a public internet either.

A solution is required to limit the network to work related activities and also inspect server communications for unusual patterns.

In one example someone’s phone was using the work WiFi to “accidentally” stream 20 GB of Netflix a day.

Re: Stop Breaking TLS

#48

Post by zeeZ »

johncolanduoni wrote: post #26
immibis wrote: post #17

Earlier quoted context omitted.

In Europe they prefer not to go to jail for privacy violations. It turns out most of these "communist" regulations are actually pretty great.

Does GDPR (or similar) establish privacy rights to an employee’s use of a company-owned machine against snooping by their employer? Honest question, I hadn’t heard of that angle. Can employers not install EDR on company-owned machines for EU employees?

They can, but the list of "if..." and "it depends..." is much longer and complicated, especially when getting to the part how the obtained information may be used

Re: Stop Breaking TLS

#49

Post by hexbin010 »

redrix wrote: post #46
nly wrote: post #27

"If you use my (private) network you follow my rules" And I find it hard to argue with that. I've been using a VPN habitually on my phone and my (personal) laptop for a decade now. Work, home, travel. Doesn't matter. It's always on.

How do you find your typical daily battery life with it always on? I’ve tried this in the past and had to revert as I found it made a noticeable difference in my day-to-day. Curious to hear the experience of others.

Was it OpenVPN that you tried in the past? Wireguard seems much better

Re: Stop Breaking TLS

#50

Post by dns_snek »

apexalpha wrote: post #36
arianvanp wrote: post #18

Complains about TLS inspection, yet fronts their website on the biggest and most widely deployed TLS introspection middle box in the world ... Why do we all disdain local TLS inspection software yet half the Internet terminates their TLS connection at Cloudflare who are most likely giving direct access to US Intelligence? It's so much worse as it's infringing on the privacy and security of billions of innocent people…

I'm not sure if you're serious but in case you are (or other people): TLS inspection is for EVERYTHING in your network, not just your publicly reachable URLs. Putting Cloudflare anti-DDoS in front of your website is not the same as breaking all encryption on your internal networks. Google can already see the content of this site since it's hosted... on the internet.

> Putting Cloudflare anti-DDoS in front of your website is not the same as breaking all encryption on your internal networks.

You misunderstood, they're complaining about it as a user. If your website uses Cloudflare then our conversation gets terminated by Cloudflare, so they get to see our unencrypted traffic and share it with whomever they want, compromising my privacy.

Which wouldn't be such a problem if it was just an odd website here or there, but Cloudflare is now essentially a TLS middle box for the entire internet with most of the problems that the article complains about, while behind hosted behind Cloudflare.

Post reply on HN