4 ms·

I'm shocked to think this is a minority opinion. Please give us certificate pinning because this type of interception is completely hostile to the end user.

pfg 11y ago
Pinning, as implemented by major browsers[1][2], doesn't prevent this. Private trust anchors are exempt from key pinning. This is deemed acceptable because in order for the proxy root to be trusted, it would have to be installed on your system, so whoever owns the proxy already has control over your client. If you think that using MitM proxies should be illegal for employers or other organizations providing clients, that's probably more of a legal discussion. I don't think there's necessarily a right to privacy when it comes to internet use at your workplace, as long as all parties are aware of this. [1]: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq... [2]: https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning#How_to_use_pinning https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...
- edwintorok 11y ago
  Could Firefox display an icon or provide a visible warning to users when traffic is being intercepted? The root cert could've been installed by malware, no?
  - JoshTriplett 11y ago
    This seems like a good first step: Firefox should display a persistent, unremovable notification bar that makes it clear that the connection appears MITMed. If people complain about that notification, the answer is "remove whatever malware you have, or complain to your network administrator".
    - wyldfire 11y ago
      It's difficult for Firefox to determine this. In this MITM case, Eve is your employer and she's modified the cert store that Firefox implicitly trusts. Now it would be interesting if firefox could distinguish between the cert store that it came with and new certs installed. Another idea would be for users to write an extension that could say "such-and-such cert is my employers and you should create a UI flag when it's being used." I know I looked into that for Chrome and it's impossible since it's not available to the extension system.
      - JoshTriplett 11y ago
        Firefox knows this any time a site has a pinned certificate and that certificate doesn't match, but chains to a certificate in the system trust store that didn't ship with Firefox.
        wyldfire 11y ago
        Ok, I expected it should be feasible. I wasn't optimistic when I read a Chrome bug that was nofix'd to make certificate info available to extensions. You sound kinda authoritative, are you suggesting that you could propose this change to firefox and it might get accepted?
        JoshTriplett 11y ago
        > Ok, I expected it should be feasible. I wasn't optimistic when I read a Chrome bug that was nofix'd to make certificate info available to extensions. This doesn't seem like a thing you could easily do from an extension, especially from a Chrome extension. But the browser itself easily has access to this information. > You sound kinda authoritative, are you suggesting that you could propose this change to firefox and it might get accepted? No, not at all; I'm not a Firefox developer. I just have strong opinions on how broken MITM is, and thoughts on how to mitigate it while dealing with the reality that an ultimatum to choose between the browser and the organizational policy will often see the browser lose. Leaving the browser capable of browsing, while showing an unremovable information bar that warns people about something MITMing their traffic, seems like a strong step towards condemning MITM that might actually work.
  - pfg 11y ago
    If malware has write access to your certificate store, it is likely that it could also modify your certificate store or browser in a way that would bypass this warning.
- JoshTriplett 11y ago
  I don't necessarily think they should be illegal. I do think that browsers should go out of their way to make life difficult for organizations that want to do this. If Firefox and Chrome both agreed to hold the line on this issue and say "MITM is always wrong", forcing prospective MITMers to maintain local hacks, then at least some organizations would listen, even if others continue to do the wrong thing.
  - meowface 11y ago
    How do you propose companies detect and investigate malware infections that communicate with peers or a command & control server over TLS?
meowface 11y ago
When you're working at a company, using a company computer, you're not an "end user", though. If the machine you're using is infected with malware, the company needs to know about it, and what the malware did. To ensure full visibility, you need TLS interception.

pfg 11y ago

Pinning, as implemented by major browsers[1][2], doesn't prevent this. Private trust anchors are exempt from key pinning. This is deemed acceptable because in order for the proxy root to be trusted, it would have to be installed on your system, so whoever owns the proxy already has control over your client. If you think that using MitM proxies should be illegal for employers or other organizations providing clients, that's probably more of a legal discussion. I don't think there's necessarily a right to privacy when it comes to internet use at your workplace, as long as all parties are aware of this. [1]: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq... [2]: https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning#How_to_use_pinning https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...

edwintorok 11y ago
Could Firefox display an icon or provide a visible warning to users when traffic is being intercepted? The root cert could've been installed by malware, no?
- JoshTriplett 11y ago
  This seems like a good first step: Firefox should display a persistent, unremovable notification bar that makes it clear that the connection appears MITMed. If people complain about that notification, the answer is "remove whatever malware you have, or complain to your network administrator".
  - wyldfire 11y ago
    It's difficult for Firefox to determine this. In this MITM case, Eve is your employer and she's modified the cert store that Firefox implicitly trusts. Now it would be interesting if firefox could distinguish between the cert store that it came with and new certs installed. Another idea would be for users to write an extension that could say "such-and-such cert is my employers and you should create a UI flag when it's being used." I know I looked into that for Chrome and it's impossible since it's not available to the extension system.
    - JoshTriplett 11y ago
      Firefox knows this any time a site has a pinned certificate and that certificate doesn't match, but chains to a certificate in the system trust store that didn't ship with Firefox.
      - wyldfire 11y ago
        Ok, I expected it should be feasible. I wasn't optimistic when I read a Chrome bug that was nofix'd to make certificate info available to extensions. You sound kinda authoritative, are you suggesting that you could propose this change to firefox and it might get accepted?
        JoshTriplett 11y ago
        > Ok, I expected it should be feasible. I wasn't optimistic when I read a Chrome bug that was nofix'd to make certificate info available to extensions. This doesn't seem like a thing you could easily do from an extension, especially from a Chrome extension. But the browser itself easily has access to this information. > You sound kinda authoritative, are you suggesting that you could propose this change to firefox and it might get accepted? No, not at all; I'm not a Firefox developer. I just have strong opinions on how broken MITM is, and thoughts on how to mitigate it while dealing with the reality that an ultimatum to choose between the browser and the organizational policy will often see the browser lose. Leaving the browser capable of browsing, while showing an unremovable information bar that warns people about something MITMing their traffic, seems like a strong step towards condemning MITM that might actually work.
- pfg 11y ago
  If malware has write access to your certificate store, it is likely that it could also modify your certificate store or browser in a way that would bypass this warning.
JoshTriplett 11y ago
I don't necessarily think they should be illegal. I do think that browsers should go out of their way to make life difficult for organizations that want to do this. If Firefox and Chrome both agreed to hold the line on this issue and say "MITM is always wrong", forcing prospective MITMers to maintain local hacks, then at least some organizations would listen, even if others continue to do the wrong thing.
- meowface 11y ago
  How do you propose companies detect and investigate malware infections that communicate with peers or a command & control server over TLS?

meowface 11y ago

When you're working at a company, using a company computer, you're not an "end user", though. If the machine you're using is infected with malware, the company needs to know about it, and what the malware did. To ensure full visibility, you need TLS interception.