4 ms·
"Like many enterprises, financial institutions depend upon the ability to decrypt TLS traffic to implement data loss protection, intrusion detection and prevent
by kbart 10y ago
"Like many enterprises, financial institutions depend upon the ability to decrypt TLS traffic to implement data loss protection, intrusion detection and prevention, malware detection, packet capture and analysis, and DDoS mitigation. Unlike some other businesses, financial institutions also rely upon TLS traffic decryption to implement fraud monitoring and surveillance of supervised employees."
I'm at lost here. What's the point of having TLS if it can be easily decrypted? Why not to ditch it altogether then? All this argument sounds somewhat fishy, just because your practices rely on insecure behavior, it doesn't mean it shouldn't be fixed for the rest of us.
- viraptor 10y agoYou still get the verification of the other side and still get the encryption on the wire, preventing external MitM. It's just TLS benefiting the company in general, not users separately. You do not want your outgoing traffic to partners and APIs to go out in plaintext. Basically the model changes from Alice <internet> Bob to Alice, Alice's employer <internet> Bob.
- xorgar831 10y agoThey key phrase is "rely upon", meaning they went down a route of using a clever hack rather than formally designing a system to meet their goals. I wonder why SOCKs proxies, which every browser supports, wouldn't work for them.
- viraptor 10y agoWhen you use a SOCKS proxy, your traffic is still encrypted from user to server. It wouldn't help them decrypt historic TLS sessions on request.
- xorgar831 10y agorather a regular http proxy that every browser supports And exactly as expected, they have a MSFT stack so they're wedged and think changing the spec is the right way to solve it. Sigh. > With TLS 1.2 we can ask the end user to take a Wireshark trace and then decrypt it with the RSA private key. With TLS 1.3 we will have to rely on the SSLKEYLOGFILE feature in Firefox and Chrome, so we want it to be available. Unfortunately, Microsoft does not allow this functionality, which is a problem in a TLS 1.3 only environment.
- lisivka 10y agoTLS can be decrypted with private key. Just keep your private key secret. For example, this feature is useful for debugging TLS encrypted communication with server by capturing data and decrypting it using WireShark. Forward secrecy breaks that.
- anonymousDan 10y agoOk I'm missing something here. If an internal bank employee initiates a TLS session to an external service, the only key the bank could hope to access is the session key if it has control over the end host, in which case it can just store the session key for each connection. What private key are you referring too if not the session key?
- deleted 10y ago[deleted]