Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueCoat and other proxies hang up during TLS 1.3

bugs.chromium.org

Post reply on HN
Print view View original

51–60 of 216 posts

Re: BlueCoat and other proxies hang up during TLS 1.3

#51

Post by gwu78 »

userbinator wrote: post #33
db48x wrote: post #10

The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.

I MITM my own connections for filtering purposes. It turns out to be the most effective way of blocking and changing crap in not just my main browser (of which I use several), but those embedded in other apps, for phoning home or otherwise.

I do the same. I have experimented with various solutions. Currently using haproxy. This also fixes problems with clients that are, thankfully, not SNI-capable.

Re: BlueCoat and other proxies hang up during TLS 1.3

#52

Post by rossy »

wildmusings wrote: post #22
db48x wrote: post #10

The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer t…

I think this SSL MITM thing has gone way too far. When an exec asks an engineer if it's possible to monitor all internet communication that goes in and out of the company network, including communication that is encrypted by TLS, the correct answer is no. In fact, this specific thing is what TLS is designed to prevent, and new implementations of the protocol are only going to get better at preventing it. The exec will only get the answer they want if they pressure the engineer, or if the engineer is trying to sell them something (like a MITM proxy.) Then the engineer will admit that it's possible to snoop on some TLS connections if you do awful things like installing fake certificates on company laptops. They may or may not mention that if they do it wrong it will degrade the security of everything on the network. God forbid the computers at a bank should be less secure than the computers in the average household because a MITM proxy is silently downgrading the security of all the TLS connections that travel through it.

Now, because engineers are so bad at saying 'no' to the people who want SSL MITM, it's apparently become a regulatory requirement. SSL MITM might let you passively surveil your employees' Facebook Messenger conversations, but it still doesn't protect you against a malicious employee who is tech-savvy (or malware written by people who have SSL MITM proxies in mind.) They could just put the information they want to smuggle out of the network into an encrypted .zip. They could even do something creative like using steganography to hide it in family photos that they upload to Facebook. The only real solution to this is to lock down the devices that people access the network on, not the network itself.

Re: BlueCoat and other proxies hang up during TLS 1.3

#53

Post by morecoffee »

Amazing how this was predicted coming on a year ago*

> At this point it's worth recalling the Law of the Internet: blame attaches to the last thing that changed.

> There's a lesson in all this: have one joint and keep it well oiled.

> When we try to add a fourth (TLS 1.3) in the next year, we'll have to add back the workaround, no doubt. In summary, this extensibility mechanism hasn't worked well because it's rarely used and that lets bugs thrive.

* https://www.imperialviolet.org/2016/05/16/agility.html

Re: BlueCoat and other proxies hang up during TLS 1.3

#54

Post by zrm »

wildmusings wrote: post #22
db48x wrote: post #10

The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer t…

> If you're using your company's network, then they have every right to monitor all of the activity on it.

It isn't a question of whether they're allowed to do it, it's a question of whether they should do it.

It's ineffective against insider exfiltration of data unless you're also doing body cavity searches for USB sticks, and if you're at that point then the sensitive network should not be connected to the internet at all.

And it's similarly ineffective against malware because TLS is not the only form of encryption. What difference does it make if someone uploads a file using opaque TLS vs. uploading an opaque encrypted file using MITM'd TLS? Banning encrypted files, even if you could actually detect them, doesn't work because they're often required for regulatory compliance.

It isn't worth the security cost. The situation in the article is bad enough, but consider what happens if the MITM appliance itself gets compromised when it has a root private key trusted by all your devices and modify access to all the traffic.

Re: BlueCoat and other proxies hang up during TLS 1.3

#55

Post by tbrowbdidnso »

userbinator wrote: post #39
coderobe wrote: post #3

Earlier quoted context omitted.

Rejecting anything it doesn't understand sounds like a bug to me. If it sees that it's TLS, it should attempt a protocol downgrade. There's absolutely no reason for this to break, as TLS 1.3 exists alongside TLS 1.2 (For now).

Rejecting anything it doesn't understand sounds like a bug to me. It sounds like a perfectly reasonable behaviour if the goal is to "fail closed", to provide more security in a fashion similar to a whitelist. If it sees that it's TLS, it should attempt a protocol downgrade. I don't remember the exact details but I recall reading that TLS has a mechanism to prevent version downgrades, precisely to defend against such…

The TLS negotiation is mutual. Both endpoints tell each other what they support and they agree on a protocol that's mutually supported.

If merely advertising 1.3 while still advertising older versions causes blue coat to break, it has a bug in TLS version negotiation.

There is no downgrade or whitelist or failing closed. Each end says what they support and BlueCoat blows up the connection if it sees that the other end supports a newer version. It should say "oh we both support 1.2 let's use that" And apparently it's done this before so there's even less an excuse for it.

Re: BlueCoat and other proxies hang up during TLS 1.3

#58

Post by FireBeyond »

hermitdev wrote: post #24
johncolanduoni wrote: post #19

Earlier quoted context omitted.

This is legally required in some sectors for regulation purposes, notably finance. I think a lot of people who casually throw out this sentiment don't appreciate that aspect of it.

+1. I work in regulatory compliance at a financial firm. My current firm doesn't do this because we don't originate trades, but when I worked at a hedge fund, all forms of electronic communications were MITM'd & recorded for regulatory reasons (and to monitor for IP theft - we did sue a soon former employee after he emailed source for a quantitative model to his personal gmail) primarily to combat or defend against i…

> and to monitor for IP theft - we did sue a soon former employee after he emailed source for a quantitative model to his personal gmail

That wouldn't be a certain Sergey Aleynikov and GS would it? (https://en.wikipedia.org/wiki/Sergey_Aleynikov)

Re: BlueCoat and other proxies hang up during TLS 1.3

#59

Post by riffic »

wildmusings wrote: post #22
db48x wrote: post #10

The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer t…

  If you're using your company's network, then they have every right to monitor all of the activity on it.
This is tantamount to steaming open and resealing the envelopes of all physical mail. Have some god damn ethics, I'd sooner quit than snoop traffic in this manner.

Re: BlueCoat and other proxies hang up during TLS 1.3

#60

Post by FireBeyond »

theluketaylor wrote: post #37
ckuehl wrote: post #32

Earlier quoted context omitted.

Totally agreed they have the right to monitor your network traffic, but I still think in most cases employees should try to push back on this. At least from my view, it's not so much that I don't want my company to know what I'm doing, as that I don't trust their software to securely MITM all of my traffic. This thread doesn't fill me with confidence about the competency of these corporate MITM proxies. And the recen…

At my workplace where we have to do tls inspection for regulatory purposes we provide an internet-only wifi network for employee personal use where we don't intercept TLS. This network is fully isolated from the corporate network and corporate devices join a different, more monitored network. I believe this strikes the best balance between regulatory compliance and employee privacy. People can still use personal emai…

> but no corporate data can be moved en mass off company servers.

How so?

1. Connect to Corp Wifi

2. git clone companyapp.git

3. Connect to Employee Personal Wifi

4. Email tgz'ed companyapp

?

Post reply on HN