The title should say "Stop inspecting TLS", the current title reads like the TLS standard or technology is modified in a way to not work properly.
For what it's worth, I knew exactly what this was going to be about before I clicked.
Stop Breaking TLS
61–70 of 175 posts
Re: Stop Breaking TLS
#62Earlier quoted context omitted.
Does GDPR (or similar) establish privacy rights to an employee’s use of a company-owned machine against snooping by their employer? Honest question, I hadn’t heard of that angle. Can employers not install EDR on company-owned machines for EU employees?
Yes, at least in the Netherlands it is generally accepted that employees can use your device personally, too. Using a device owned by your company to access your personal GMail account does NOT void your legal right to privacy.
So does nobody in Europe use an EDR or intercepting proxy since GDPR went into force?
Re: Stop Breaking TLS
#63Earlier quoted context omitted.
In Europe they prefer not to go to jail for privacy violations. It turns out most of these "communist" regulations are actually pretty great.
Does GDPR (or similar) establish privacy rights to an employee’s use of a company-owned machine against snooping by their employer? Honest question, I hadn’t heard of that angle. Can employers not install EDR on company-owned machines for EU employees?
(IANAL) I don't think there is a simple response to that, but I guess that given that the employer:
- has established a detailed policy about personal use of corporate devices
- makes a fair attempt to block work unrelated services (hotmail, gmail, netflix)
- ensures the security of the monitored data and deletes it after a reasonable period (such as 6–12 months)
- and uses it only to apply cybersecurity-related measures like virus detection, UNLESS there is a legitimate reason to target a particular employee (legal inquiry, misconduct, etc.)
I would say that it's very much doable.
Edit: More info from the Dutch regulator https://english.ncsc.nl/publications/factsheets/2019/juni/01...
Re: Stop Breaking TLS
#64Earlier quoted context omitted.
Yes. GDPR covers all handling of PII that a company does. And its sort of default deny, meaning that a company is not allowed to handle (process and/or store) your data UNLESS it has a reason that makes it legal. This is where it becomes more blurry: figuring out if the company has a valid reason. Some are simple, eg. if required by law => valid reason. GDPR does not care how the data got “in the hands of” the compan…
What if your employer says “don’t access your health records on our machine”? If you put private health information in your Twitter bio, Twitter is not obligated to suddenly treat it as if they were collecting private health information. Otherwise every single user-provided field would be maximally radioactive under GDPR.
If the employer says so and I do so anyway then that’s a employment issue. I still have to follow company rules. But the point is that the company needs to delete the collected data as soon as possible. They are still not allowed to store it.
Re: Stop Breaking TLS
#65More and more big customers (especially banks) are requiring this kind of self-inflicted-MITM attack from all their suppliers. Do you want to have customers? Get ready for zscaler!
How do you propose compliance with their exfiltration protection requirements? (And “turn down $ from those customers” is not an answer)
Re: Stop Breaking TLS
#66I work for a school. My traffic is not MITM'd, but the kids' traffic is, because we don't want them using their school-issued laptops to play games or go shopping, and you can't adequately block stuff if it's all encrypted.
Whitelists instead of blacklists?
Re: Stop Breaking TLS
#67I agree with the sentiment, but I think it's a pretty naive view of the issue. Companies will want all info they can in case some of their workers does something illegal-inappropiate to deflect the blame. That's a much more palpable risk than "local CA certificates being compromised or something like that. And some of the arguments are just very easily dismissed. You don't want your employer to see you medical record…
TLS inspection can _never_ be implemented in a good way, you will always have cases where it breaks something and most commonly you will see very bad implementations that break most tools (e.g. it is very hard to trust a new CA because each of OS/browser/java/python/... will have their own CA store)
This means devs/users will skip TLS verification ("just make it work") making for a dangerous precedent. Companies want to protect their data? Well, just protect it! Least privilege, data minimization, etc is all good strategies for avoiding data leaking
Re: Stop Breaking TLS
#68As a sysadmin I also hate this. Instead, I do block stuff based on DNS requests and I also block any other DNS provider as well as malicious IPs.
At this point in time, Microsoft is the bigger enemy here - some of their policies are just insane and none of this MITM will help [0][1]
[0] https://www.microsoft.com/en-us/microsoft-365/roadmap?id=490...
[1] https://techcommunity.microsoft.com/blog/microsoft365copilot...
Re: Stop Breaking TLS
#69Complains about TLS inspection, yet fronts their website on the biggest and most widely deployed TLS introspection middle box in the world ... Why do we all disdain local TLS inspection software yet half the Internet terminates their TLS connection at Cloudflare who are most likely giving direct access to US Intelligence? It's so much worse as it's infringing on the privacy and security of billions of innocent people…
I'm not sure if you're serious but in case you are (or other people): TLS inspection is for EVERYTHING in your network, not just your publicly reachable URLs. Putting Cloudflare anti-DDoS in front of your website is not the same as breaking all encryption on your internal networks. Google can already see the content of this site since it's hosted... on the internet.
...do you send private messages using services hosted on publicly reachable URLs?
Re: Stop Breaking TLS
#70I work for a school. My traffic is not MITM'd, but the kids' traffic is, because we don't want them using their school-issued laptops to play games or go shopping, and you can't adequately block stuff if it's all encrypted.
Whitelists instead of blacklists?
I'm pretty sure we'd still need to break TLS. Domain-level just isn't granular enough.