Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Security Impact of HTTPS Interception [pdf]

jhalderm.com

Post reply on HN
Print view View original

51–60 of 67 posts

Re: The Security Impact of HTTPS Interception [pdf]

#51

Post by zeveb »

riffic wrote: post #44
zeveb wrote: post #36

Earlier quoted context omitted.

> Employees are often required to install local certs (or applications/scripts that do that) - that doesn't mean the host is entirely compromised. If they are forced to install those certs, then the computers they use belong to their employers, and those computers are obeying their proper owners. I fail to see the problem. Don't use your work computer for things you don't want your work to be able to detect, intercep…

Don't use your work computer for things you don't want your work to be able to detect, intercept & modify. with that logic, don't get mail sent to the office because your employer has every right to open and reseal the envelope. You know who also has that right? Prisons.

> with that logic, don't get mail sent to the office because your employer has every right to open and reseal the envelope.

I don't have things sent to the office unless they comply with my employer's policies (e.g. I'd never have a weapon mailed here), and unless I'm happy with my employer having information about my packages.

I'm curious what line of reasoning would justify me doing such a thing and expecting privacy.

> You know who also has that right? Prisons.

You know who also has that right? You, on any network and hardware you own. My employer owns my laptop and the network it's connected to: of course it has every right to inspect its own property.

Re: The Security Impact of HTTPS Interception [pdf]

#52

Post by loup-vaillant »

riffic wrote: post #44
zeveb wrote: post #36

Earlier quoted context omitted.

> Employees are often required to install local certs (or applications/scripts that do that) - that doesn't mean the host is entirely compromised. If they are forced to install those certs, then the computers they use belong to their employers, and those computers are obeying their proper owners. I fail to see the problem. Don't use your work computer for things you don't want your work to be able to detect, intercep…

Don't use your work computer for things you don't want your work to be able to detect, intercept & modify. with that logic, don't get mail sent to the office because your employer has every right to open and reseal the envelope. You know who also has that right? Prisons.

That's employment for you. Employees are not treated as autonomous agents. More like untrustworthy children.

For my last gig, I worked at some company on behalf of another. This workplace was quite explicit about intercepting and monitoring everything. I pondered for a second whether I should use this place's computers to log to my employer's webmail. I gave up and did it, because I wasn't going to read or write work emails outside of office hours.

Personal stuff however I didn't dare.

Re: The Security Impact of HTTPS Interception [pdf]

#53

Post by loup-vaillant »

zeveb wrote: post #51
riffic wrote: post #44

Earlier quoted context omitted.

Don't use your work computer for things you don't want your work to be able to detect, intercept & modify. with that logic, don't get mail sent to the office because your employer has every right to open and reseal the envelope. You know who also has that right? Prisons.

> with that logic, don't get mail sent to the office because your employer has every right to open and reseal the envelope. I don't have things sent to the office unless they comply with my employer's policies (e.g. I'd never have a weapon mailed here), and unless I'm happy with my employer having information about my packages. I'm curious what line of reasoning would justify me doing such a thing and expecting priva…

> * My employer owns my laptop and the network it's connected to: of course it has every right to inspect its own property.*

Careful there: there's a difference between capability and right. Many legislations forbid employers to put surveillance cameras in the bathroom for instance. There is a level of privacy employees can legally expect.

E-mail is similar: if your employer intercepts your e-mail just because you read it at work, it is likely a breach of correspondence secrecy (in France it would be). This likely applies even if you're at fault for using the company's resources on personal matters.

While "don't trust your employer's network" is elementary operational security everyone should be taught at school, 90% of the population don't know what computers can do, let alone how they work. Because of that, their expectations are social, not technical.

Re: The Security Impact of HTTPS Interception [pdf]

#54

Post by ownagefool »

einrealist wrote: post #42

Its sad that interception receives such a bad reputation because of broken security products. Yes, a proxy is a weak link. But if implemented properly and in a trustworthy way, then its better than having endpoint security, which is often worse. And no, the proxy does not belong on the endpoint itself! If organizations with proxy interception are not able to scan traffic, they will just drop the traffic. Instead of u…

Why does the proxy not belong on the endpoint?

Re: The Security Impact of HTTPS Interception [pdf]

#55

Post by JoshTriplett »

simias wrote: post #13
pfg wrote: post #10

Earlier quoted context omitted.

Trying to fight a local attacker with root (which is necessary to add a certificate to the trust stores on most platforms) isn't worth the effort. It's easy for the admin to bypass and would cause even more warning fatigue. That's not to say I disagree with the sentiment that this is something employers (and other organizations providing access to devices) should be obliged to disclose, but that is perhaps more of a…

> It's easy for the admin to bypass If it involves patching and recompiling the browser it wouldn't be that trivial for your average sysadmin. Besides I don't see why the admin would be hostile to the users being aware that they're being monitored. As you point out companies generally disclose that anyway.

> Besides I don't see why the admin would be hostile to the users being aware that they're being monitored.

Agreed. We could argue all day about companies who think they need to intercept traffic, but why would anyone who believed they had a legitimate reason to do so want to do so silently without any notification?

A persistent infobar near the address bar, for instance, would work nicely. And anyone working in a hostile environment with such monitoring imposed on them (a bank, for instance) would then have a much clearer warning that they shouldn't use their work device for anything they want to keep private.

Re: The Security Impact of HTTPS Interception [pdf]

#56

Post by einrealist »

ownagefool wrote: post #54
einrealist wrote: post #42

Its sad that interception receives such a bad reputation because of broken security products. Yes, a proxy is a weak link. But if implemented properly and in a trustworthy way, then its better than having endpoint security, which is often worse. And no, the proxy does not belong on the endpoint itself! If organizations with proxy interception are not able to scan traffic, they will just drop the traffic. Instead of u…

Why does the proxy not belong on the endpoint?

For various reasons: you probably have more endpoints on your network than proxy servers and thus a bigger attack surface. Keeping the endpoints up-to-date is harder (e.g. laptops that are not permanently attached to the network to receive updates). If your endpoints are workstations, human interaction (e.g. installing malicious software, opening malicious attachements) and the overall complexity of the system (e.g. GUI, multiple users) makes it weaker than a central, dedicated, isolated, stripped down and locked down set of proxy servers. And finally, process isolation is really, really hard (if your countermeasure _only_ runs on the target (endpoint), you already weakened your position).

Re: The Security Impact of HTTPS Interception [pdf]

#57

Post by closeparen »

cesarb wrote: post #30
hlandau wrote: post #26

Earlier quoted context omitted.

Personally I'd be happy to DoS my sites by breaking them when policy MitM is used, as an act of solidarity. I even wrote a half-joking spec for it: https://hlandau.github.io/draft-landau-websec-key-pinning-re... Seems like it should be feasible to develop modules for HTTP frontends to detect policy MitM based on the techniques described in this article and enable conditional denial of service.

There's another way to do that: require client certificates. The MITM proxy cannot present the client certificate to the server, since it doesn't have the corresponding private key. Unfortunately, the user interface for client certificates is a complete pain, so they are rarely used. But they're the only true way for a server to make sure it's talking directly to a client, in the same way server certificates can allo…

>The MITM proxy cannot present the client certificate to the server, since it doesn't have the corresponding private key.

The MITM proxy is operated by the same department that has root on all the endpoints it's intercepting. If necessary, the "endpoint protection" product will grab the private key, or just scrape the details of the browser session from the browser's memory rather than at network level.

Re: The Security Impact of HTTPS Interception [pdf]

#58

Post by caf »

zeveb wrote: post #36
eeZah7Ux wrote: post #11

Earlier quoted context omitted.

Don't assume the there's a local attacker with root. Employees are often required to install local certs (or applications/scripts that do that) - that doesn't mean the host is entirely compromised.

> Employees are often required to install local certs (or applications/scripts that do that) - that doesn't mean the host is entirely compromised. If they are forced to install those certs, then the computers they use belong to their employers, and those computers are obeying their proper owners. I fail to see the problem. Don't use your work computer for things you don't want your work to be able to detect, intercep…

That's fine, but that doesn't justify doing it silently - if you're going to claim the right to detect, intercept and modify you should have no problems with being completely transparent about doing so.

Re: The Security Impact of HTTPS Interception [pdf]

#59

Post by snowwrestler »

riffic wrote: post #44
zeveb wrote: post #36

Earlier quoted context omitted.

> Employees are often required to install local certs (or applications/scripts that do that) - that doesn't mean the host is entirely compromised. If they are forced to install those certs, then the computers they use belong to their employers, and those computers are obeying their proper owners. I fail to see the problem. Don't use your work computer for things you don't want your work to be able to detect, intercep…

Don't use your work computer for things you don't want your work to be able to detect, intercept & modify. with that logic, don't get mail sent to the office because your employer has every right to open and reseal the envelope. You know who also has that right? Prisons.

Common mistake on HN: the law is not logical.

The law says that if employers own the computers they provide to employees, then employers have broad latitude to monitor how those computers are used.

A different law says that only the recipient of a US Postal letter may open it. If you receive a personal letter at your office via US Postal Service, your employer cannot legally open it.

I'm not up to date on what the law says about FedEx or UPS.

Post reply on HN