Industry Concerns about TLS 1.3
ietf.org
Industry Concerns about TLS 1.3
1–10 of 194 posts
Re: Industry Concerns about TLS 1.3
#2>>> My view concerning your request: no.
is probably the best response for the request.
On a related note though, it's always amazing how on one hand Big Banking tries to show that it's in touch with the latest tech developments (Bitcoin Consortiums, RFID/NFC payments) etc. but on the other hand display a very shallow understanding of how secure systems should work.
Re: Industry Concerns about TLS 1.3
#3Well, that was kind of a burn.
Was the argument by the bankers basically a complaint that retooling would be very expensive? and/or that employee surveillance would be more difficult? (yeah, I'm sure everyone is a fan of that!)
Re: Industry Concerns about TLS 1.3
#4"...almost all of whom are running TLS internally and have significant, security-critical investments in out-of-band TLS decryption. Like many enterprises, financial institutions depend upon the ability to decrypt TLS traffic to implement data loss protection, intrusion detection and prevention, malware detection, packet capture and analysis, and DDoS mitigation. Unlike some other businesses, financial institutions also rely upon TLS traffic decryption to implement fraud monitoring and surveillance of supervised employees."
And thus essentially defeating the entire purpose of TLS. Can you please help us continue doing this with the new version of TLS too. Thanks. Love. Big Banks.
Re: Industry Concerns about TLS 1.3
#5I don't understand why the banks need to change TLS 1.3 to spy on their employees. When I was working at a bank, there were literally no routes from the Intranet to the Internet. Everything went through a proxy that blocked 95% of the Internet. Had to run a proxy server on jrock.us in order to get anything done. (They just bought the list of sites to block, and jrock.us never ended up on it. Blacklisting, very good security technique...)
Re: Industry Concerns about TLS 1.3
#6"Like many enterprises, financial institutions depend upon the ability to decrypt TLS traffic to implement data loss protection, intrusion detection and prevention, malware detection, packet capture and analysis, and DDoS mitigation. Unlike some other businesses, financial institutions also rely upon TLS traffic decryption to implement fraud monitoring and surveillance of supervised employees."
I'm at lost here. What's the point of having TLS if it can be easily decrypted? Why not to ditch it altogether then? All this argument sounds somewhat fishy, just because your practices rely on insecure behavior, it doesn't mean it shouldn't be fixed for the rest of us.
Re: Industry Concerns about TLS 1.3
#7Well, that was kind of a burn. Was the argument by the bankers basically a complaint that retooling would be very expensive? and/or that employee surveillance would be more difficult? (yeah, I'm sure everyone is a fan of that!)
mitm surveillance of employee traffic is basically a cornerstone of enterprise security since those networks are designed to be very squishy on the inside. Thankfully Google is turning the assumption that the perimeter needs to extend to your rather vulnerable clients on its head but that will be several years before it's productized enough that middle managers will be convinced to buy it by a VAR over a game of golf.
Re: Industry Concerns about TLS 1.3
#8>>> My view concerning your request: no. is probably the best response for the request. On a related note though, it's always amazing how on one hand Big Banking tries to show that it's in touch with the latest tech developments (Bitcoin Consortiums, RFID/NFC payments) etc. but on the other hand display a very shallow understanding of how secure systems should work.
I think that's a very biased way of looking at this request. They don't necessarily have a shallow understanding. They have a set of very strict rules they have to obey. If that means no privacy for the employees, then they have to implement no privacy for the employees. The reasoning of the author has been explained pretty well in my opinion.
But that's completely orthogonal to the understanding how the secure systems work.
Re: Industry Concerns about TLS 1.3
#9>>> My view concerning your request: no. is probably the best response for the request. On a related note though, it's always amazing how on one hand Big Banking tries to show that it's in touch with the latest tech developments (Bitcoin Consortiums, RFID/NFC payments) etc. but on the other hand display a very shallow understanding of how secure systems should work.
I call it paper security or checklist security. Usually it is about implementing enough to check off a list of requirements from some document. Antivirus installed? Check (Nevermind it is a Linux box and AV loads a dubious proprietary driver in the kernel with a huge attack surface and remote exploit posibility because of how it does updates), such and such EAL-4 operating system intalled? Check, and so on ...
So they tick all the boxes and in the end up with a worse off posture than if they just stayed with defaults for example.
Re: Industry Concerns about TLS 1.3
#10"Like many enterprises, financial institutions depend upon the ability to decrypt TLS traffic to implement data loss protection, intrusion detection and prevention, malware detection, packet capture and analysis, and DDoS mitigation. Unlike some other businesses, financial institutions also rely upon TLS traffic decryption to implement fraud monitoring and surveillance of supervised employees." I'm at lost here. What…
You still get the verification of the other side and still get the encryption on the wire, preventing external MitM. It's just TLS benefiting the company in general, not users separately. You do not want your outgoing traffic to partners and APIs to go out in plaintext.
Basically the model changes from Alice Bob to Alice, Alice's employer Bob.