61–70 of 105 posts
The US government has basically declared "HTTPS/TLS Interception Considered Harmful". This is going to be interesting as all the major security load blanacer/appliances out there offer this as a standard service at this point.
They say pretty plainly that you need to ensure that such products provide correct certificate validation, since the client cannot do so reliably.
Earlier quoted context omitted.
> financial firms have to record everything their employees do for some regulations Phone calls, emails, instant messages and other forms of client contact, yes. Internet browsing history? No. Rest assured, many firms do this. But it's because they decided to, not because of regulation.
Worked for Big 4. They did not log my phone calls or sniff my TLS traffic.
The US government has basically declared "HTTPS/TLS Interception Considered Harmful". This is going to be interesting as all the major security load blanacer/appliances out there offer this as a standard service at this point.
Earlier quoted context omitted.
As far as I can tell this is targetted at what I would expect: "antivirus" and compliance tools built into firewalls, not reverse proxies built into load balancers.
There is limited distinction there. Both terminate and re-establish TLS sessions.
I still find it unfortunately shallow analysis. I'm currently fighting a battle in a company in the middle of rolling out Blue Coat ProxySG. I only became aware of it because it began causing interruptions to our work since none of the development tools get the necessary root cert to validate the certs that the proxy is rewriting. The root cert is only installed into the Windows credentials to make browsers work and…
A way forward might be to start requiring TLS client certificates for business products. :-)
For us, we use TLS client certificate authentication to authenticate almost all our users so any TLS MITM breaks that and is unacceptable. This is really common and tens of millions of people use TLS client certificates this way everyday -- mostly with client certificates on smartcards.
any recommendations on tutorials/guides for better understanding the world of TLS, certificates, and so on? i don't feel like i have a healthy mastery of the ideas discussed in articles like this one.
HTTPS is basically HTTP over TLS, so start with RFCs: - TLS v1.2 ( https://tools.ietf.org/html/rfc5246 ) - Certificate validation ( https://tools.ietf.org/html/rfc6960 ) - PKI is a little more tricky, as there's no single standard that defines it, though to get basic idea of what are certificates read RFC 5280 ( https://tools.ietf.org/html/rfc5280 ). Sure, you can dig as deep as you want, but these resources should g…
Reading the title ... no shit.
Earlier quoted context omitted.
That would defeat the whole point of a proxy, if I can't see what they're doing and report on people who are doing the wrong thing (according to their employment contract), then why bother?
Because if you block it then they can't do it and you have nothing to report. Everyone wins.
The US government has basically declared "HTTPS/TLS Interception Considered Harmful". This is going to be interesting as all the major security load blanacer/appliances out there offer this as a standard service at this point.
No, they haven't. They say pretty plainly that you need to ensure that such products provide correct certificate validation, since the client cannot do so reliably.
> In general, organizations considering the use of HTTPS inspection should carefully consider the pros and cons of such products before implementing
So I think there's at least some element of "don't do this unless you have to" in there.
But for the most part yeah, the alert seems to be more about ensuring the interception is done securely than about not doing it at all.