Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueCoat and other proxies hang up during TLS 1.3

bugs.chromium.org

Post reply on HN
Print view View original

91–100 of 216 posts

Re: BlueCoat and other proxies hang up during TLS 1.3

#91

Post by deathanatos »

userbinator wrote: post #39
coderobe wrote: post #3

Earlier quoted context omitted.

Rejecting anything it doesn't understand sounds like a bug to me. If it sees that it's TLS, it should attempt a protocol downgrade. There's absolutely no reason for this to break, as TLS 1.3 exists alongside TLS 1.2 (For now).

Rejecting anything it doesn't understand sounds like a bug to me. It sounds like a perfectly reasonable behaviour if the goal is to "fail closed", to provide more security in a fashion similar to a whitelist. If it sees that it's TLS, it should attempt a protocol downgrade. I don't remember the exact details but I recall reading that TLS has a mechanism to prevent version downgrades, precisely to defend against such…

I've written a similar rebuttal to your sibling's comment here[1].

This isn't "failing closed", and this isn't a whitelist. TLS allows you to whitelist to certain versions of the protocol during the initial negotiation at the start of the protocol; that is the opportunity for either end to state what version of the protocol they'd like. It is not permissible in the protocol to close the connection as Blue Coat is doing.

This isn't a downgrade attack, either: both server and client are free to choose their protocol version at the beginning. The client & server will later verify that the actual protocol in use is the one they intended; this is what prevents downgrades.

[1]: https://news.ycombinator.com/item?id=13751737

Re: BlueCoat and other proxies hang up during TLS 1.3

#92

Post by fulafel »

btbuilder wrote: post #70
riffic wrote: post #59

Earlier quoted context omitted.

If you're using your company's network, then they have every right to monitor all of the activity on it. This is tantamount to steaming open and resealing the envelopes of all physical mail. Have some god damn ethics, I'd sooner quit than snoop traffic in this manner.

All MITM proxies I know require an enterprise CA trusted by the end-point. If that CA is on your machine the endpoint is probably owned by your employer. It is legal in most jurisdictions for your employer to monitor the usage of resources they have provided, be it computer or network. I would never trust a company device, or company network, with anything I consider sensitive. Use your own device and keep it on cell…

This is not a US discussion though, it's about the whole web.

Re: BlueCoat and other proxies hang up during TLS 1.3

#93

Post by db48x »

userbinator wrote: post #33
db48x wrote: post #10

The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.

I MITM my own connections for filtering purposes. It turns out to be the most effective way of blocking and changing crap in not just my main browser (of which I use several), but those embedded in other apps, for phoning home or otherwise.

Good point. There's no third party requiring you to do so, though.

Re: BlueCoat and other proxies hang up during TLS 1.3

#94

Post by deathanatos »

theluketaylor wrote: post #67
FireBeyond wrote: post #60

Earlier quoted context omitted.

> but no corporate data can be moved en mass off company servers. How so? 1. Connect to Corp Wifi 2. git clone companyapp.git 3. Connect to Employee Personal Wifi 4. Email tgz'ed companyapp ?

When connecting a corporate device to any non-corporate network (including the employee wifi) you can't go anywhere until the vpn is connected. The vpn routes you through all the same inspection points as being on premise.

And how can your inspection points verify that data isn't being exfiltrated? Arbitrary pipes can be made over SSH, over DNS, and I don't really consider these advanced. How do you handle techniques like chaffing and winnowing, steganography, or someone who knows how to transmit an arbitrary number of bits using only two bits?

Re: BlueCoat and other proxies hang up during TLS 1.3

#95

Post by kbart »

jlgaddis wrote: post #79
quotemstr wrote: post #4

Earlier quoted context omitted.

Ridiculously conservative middleboxes are why we can't have nice things and why we need to encrypt all new protocols, security properties aside.

[ off-topic comment deleted ]

Probably you have already (mis)clicked (down)vote button on this comment before. It's easy to do accidentally, especially on touchscreen.

Re: BlueCoat and other proxies hang up during TLS 1.3

#96

Post by jlgaddis »

kbart wrote: post #95
jlgaddis wrote: post #79

Earlier quoted context omitted.

[ off-topic comment deleted ]

Probably you have already (mis)clicked (down)vote button on this comment before. It's easy to do accidentally, especially on touchscreen.

I was pretty sure that wasn't it. I noticed it as soon as I first saw the comment.

That's the simplest explanation, though, so that's probably what happened. Oh well.

Re: BlueCoat and other proxies hang up during TLS 1.3

#97

Post by zrm »

jlgaddis wrote: post #88
zrm wrote: post #54

Earlier quoted context omitted.

> If you're using your company's network, then they have every right to monitor all of the activity on it. It isn't a question of whether they're allowed to do it, it's a question of whether they should do it. It's ineffective against insider exfiltration of data unless you're also doing body cavity searches for USB sticks, and if you're at that point then the sensitive network should not be connected to the internet…

> It's ineffective against insider exfiltration of data unless you're also doing body cavity searches for USB sticks ... I dunno. I know plenty of people who might want to work on an Excel spreadsheet at home over the weekend and so might e-mail it to their personal e-mail account. They would almost certainly reconsider, however, if it required copying that spreadsheet to a flash drive that they then had to hide in t…

It depends how much the data is worth. That's really the problem.

Suppose you're a college dorm network. Then you can't justify TLS MITM because the risk of your MITM device actively creating a security hole that leads to all the students' bank passwords being stolen is greater than any benefit from centrally monitoring the traffic in that environment.

Suppose you're a highly classified government research lab. Then you can't justify TLS MITM because the bad guys are skilled foreign government agents and you need to isolate the network from the internet.

And there is no happy medium because the risk and cost of having all your TLS-secured data compromised scales with the target value. The higher the target value the higher the risk created by the MITM proxy, all the way up to the point that you can justify isolating the network from the internet.

Re: BlueCoat and other proxies hang up during TLS 1.3

#98

Post by nikanj »

ehsankia wrote: post #5
coderobe wrote: post #3

Earlier quoted context omitted.

Rejecting anything it doesn't understand sounds like a bug to me. If it sees that it's TLS, it should attempt a protocol downgrade. There's absolutely no reason for this to break, as TLS 1.3 exists alongside TLS 1.2 (For now).

The surprising part (or maybe not) is that BlueCoat had been made aware of this change months ago and never got around properly testing it. This one of the softwares main purpose, and the fact that they didn't even make sure it works on the newest Chrome, leading to such a mess, is pretty sad.

The way this is going to be spinned, I promise you, is: Google released a new version of Chrome, and support for that upgrade is in BlueCoat v.next. Here's an invoice for the new license+consulting services for the upgrade.

In corporate environments, the last thing that changes is the thing that gets blamed. BlueCoat was not upgraded, Chrome was, and now things are broken? Not their fault.

Re: BlueCoat and other proxies hang up during TLS 1.3

#99

Post by tehabe »

I kinda hoped that TLS 1.3 had some magick in it so that those MITM proxies would no longer work because they can be recognized by the browser and the browser can say: how about no.

Also, wasn't there some security issues relating to the possibility to downgrade the encryption of a connection?

Re: BlueCoat and other proxies hang up during TLS 1.3

#100

Post by travoc »

riffic wrote: post #59
wildmusings wrote: post #22

Earlier quoted context omitted.

Without an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer t…

If you're using your company's network, then they have every right to monitor all of the activity on it. This is tantamount to steaming open and resealing the envelopes of all physical mail. Have some god damn ethics, I'd sooner quit than snoop traffic in this manner.

You'll never be able to work for an American financial institution. These controls are mandated by regulators.
Post reply on HN