4 ms·

As an aside, this is one of the reasons why I believe locally installed certificates overriding pinning has a quickly eroding shelf life... At some point, somet

by davidu 11y ago

As an aside, this is one of the reasons why I believe locally installed certificates overriding pinning has a quickly eroding shelf life... At some point, something bad will happen like this (or malware-based) and Chrome will raise their hand and say, "sorry enterprises, no more MITM at all, even for locally installed certificates." After that, IE and Firefox will follow and crypto will no longer be so trivially subverted by enterprise organizations.

tptacek 11y ago
That's another arms race Chrome will lose, because the market for the kinds of enterprise configuration management and "host protection" tools that could override this policy exists and is very lucrative. Chrome would simply be begging enterprise security companies to release products to fuck up their browser. I disagree with you.
- davidu 11y ago
  Part of me hopes you are right, because I don't like seeing Chrome/Google throw it's muscle around. Part of me hopes you are wrong, because I think encryption and security don't need to be opposing forces and MITM isn't required for strong security (though maybe for good GRC and audit).
  - teacup50 11y ago
    Key pinning you can't override locally is DRM.
    - davidu 11y ago
      That's a super interesting way of framing the conversation.
- cwyers 11y ago
  Or someone just forks Chromium and releases Chromium For Enterprise.
  - tptacek 11y ago
    Which again helps nobody, because forks of Chromium will inevitably lag on security fixes.
    - kibwen 11y ago
      At my last job, my manager tasked me with finding a way to defeat Chrome's update mechanism for all of our employees because a new version had introduced a bug that broke our internal web applications. I disregarded his plan and just introduced a workaround for the bug, but the point remains that enterprise customers already consider it a value-add to freeze their software in time for perpetuity. Hell, my workstation was running XP until I needled IT to grant me a "premature" upgrade to Win 7.
      - tptacek 11y ago
        Sorry, I meant that from the perspective of the Chromium team.
        kibwen 11y ago
        Indeed, I agree with the policy that if someone can control what's installed locally, they've already won.
- bcoates 11y ago
  Chrome already has an "enterprise" version, moving a less braindead corporate monitoring system then MITM certs into it would probably be a good thing. It would also be a good way for them to start pushing a "two party consent" model for private wiretapping -- It's illegal for my employer to record my office phone because it's a violation of the other party's rights. Facebook has as much a stake in not letting employers monitor employee's social media use as the employees do.
pornel 11y ago
Response from Chrome engineers I've heard is that they won't try to fight this, because anything intentionally overridden locally is already a game over. If they block custom certificates, then malware will patch the process to disable the checks. And in this case the Kazakh government could say "For your safety, the Chrome doesn't work with our Internet. Please use our Khrome instead".
yuhong 11y ago
Someone suggested using a special icon in the address bar to denote this kind of thing.
- davidu 11y ago
  This would be smart. It doesn't need to be ominous, just informative.

by davidu 11y ago

tptacek 11y ago

That's another arms race Chrome will lose, because the market for the kinds of enterprise configuration management and "host protection" tools that could override this policy exists and is very lucrative. Chrome would simply be begging enterprise security companies to release products to fuck up their browser. I disagree with you.

davidu 11y ago
Part of me hopes you are right, because I don't like seeing Chrome/Google throw it's muscle around. Part of me hopes you are wrong, because I think encryption and security don't need to be opposing forces and MITM isn't required for strong security (though maybe for good GRC and audit).
- teacup50 11y ago
  Key pinning you can't override locally is DRM.
  - davidu 11y ago
    That's a super interesting way of framing the conversation.
cwyers 11y ago
Or someone just forks Chromium and releases Chromium For Enterprise.
- tptacek 11y ago
  Which again helps nobody, because forks of Chromium will inevitably lag on security fixes.
  - kibwen 11y ago
    At my last job, my manager tasked me with finding a way to defeat Chrome's update mechanism for all of our employees because a new version had introduced a bug that broke our internal web applications. I disregarded his plan and just introduced a workaround for the bug, but the point remains that enterprise customers already consider it a value-add to freeze their software in time for perpetuity. Hell, my workstation was running XP until I needled IT to grant me a "premature" upgrade to Win 7.
    - tptacek 11y ago
      Sorry, I meant that from the perspective of the Chromium team.
      - kibwen 11y ago
        Indeed, I agree with the policy that if someone can control what's installed locally, they've already won.
bcoates 11y ago
Chrome already has an "enterprise" version, moving a less braindead corporate monitoring system then MITM certs into it would probably be a good thing. It would also be a good way for them to start pushing a "two party consent" model for private wiretapping -- It's illegal for my employer to record my office phone because it's a violation of the other party's rights. Facebook has as much a stake in not letting employers monitor employee's social media use as the employees do.

pornel 11y ago

Response from Chrome engineers I've heard is that they won't try to fight this, because anything intentionally overridden locally is already a game over. If they block custom certificates, then malware will patch the process to disable the checks. And in this case the Kazakh government could say "For your safety, the Chrome doesn't work with our Internet. Please use our Khrome instead".

yuhong 11y ago

Someone suggested using a special icon in the address bar to denote this kind of thing.

davidu 11y ago
This would be smart. It doesn't need to be ominous, just informative.