6 ms·

Sadly for companies in some industries (i.e defense or healthcare) there are regulatory compliance issues that force them into running something that can interc

by zaphar 10y ago

Sadly for companies in some industries (i.e defense or healthcare) there are regulatory compliance issues that force them into running something that can intercept TLS connections. These companies are many times in a position of either weakening security or failing an audit. Until the regulations catch up they will be stuck between a rock and a hard place.

Jonnax 10y ago
Well part of the argument that Google/Mozilla are putting forward is that some software does their man in the middle attack in bad ways that compromise user security. The picture in the article states: Avast 11.7: Advertises DES as a cipher (It's been vulnerable for more than a decade) AVG and Bit Defender: Vulnerable to Logjam and POODLE Kaspersky: Vulnerable to CRIME Net Nanny, KinderGate, CYBERsitter, NOD32, Kaspersky Internet Security (Mac): Doesn't validate certificates.
- zaphar 10y ago
  Sure but for most of these companies conducting a security audit of their AV solution is very much not something are going to be competent at. The typical auditing companies they might hire for there compliance reasons are also not going to be competent at it. As a result, due to a lack of knowledge and a need to check boxes, they will be choosing AV solutions that lower their security. It's a perfect storm. Especially since many of the ones on the list are considered best in market for these people.
- Neil44 10y ago
  I can only speak to Eset as it's the only one I am sure about, but it definitely does validate certs. I have screen grabs of validation errors because they were interesting.
fulafel 10y ago
They should just live without HTTPS and not break it for everyone else.
- lolc 10y ago
  They only break HTTPS for themselves. And not using HTTPS is not an option anymore.
  - fulafel 10y ago
    They throw their weight around to get MITM support into browsers, see eg the pinning discussion in another comment.
tonyztan 10y ago
TLS interception is not the problem. Improper implementation of the protocol is. AV / Appliance vendors need to configure their MITM proxies correctly so that they utilize the same protocols and verifications that the browsers have.
- KingMob 10y ago
  But these devices are rarely updated, so even one that's safe now has no guarantee that it can be kept safe in the future. As a more general issue, TLS interception is a problem. Widespread acceptance of TLS proxying violates the TLS contract, which is that all my communications between a website and my browser are safely encrypted.
  - madars 10y ago
    The OP's point is that in some realms the user is forbidden (not by technical means, of course, but by law) from entering into such contracts or, at least, executing them. I completely agree that the current state of affairs is gravely deficient :(
- deburo 10y ago
  The article is also pointing out that .. "The researchers urge antivirus vendors to stop intercepting HTTPS altogether, since the products already have access to the local filesystem, browser memory, and content loaded over HTTPS" I wonder why they are resorting to TLS interception then. Is it just easier to intercept TLS then inspecting memory? Is it just a lack of perspective?
  - WorldMaker 10y ago
    Ease of deployment? At least for corporate interception the answer seems to be just how much easier it is to deploy a central proxy than to make sure that client software is up to date. (Forgetting, conveniently, that you have to update client certificate stores every so often.) Similarly the "it's how we've always done it" defense because companies have used that approach for HTTP for so long they don't want to invest in a new approach now that HTTPS makes it much less viable. As for consumer AV products, I have no idea how they defend that other than "let's have our tentacles in all the pies".
hehheh 10y ago
Should people in those industries have access to the outside web on the computers that have even a smidge of access to data that must be kept private by law? I'd say "no" -- I can't think of a scenario in which a healthcare device needs access to Google or hacker news or whatever. They could just use a whitelist and replace all CAs on the computer with a (set of?) private CA(s) that allow the user to do work on information that requires such security.
- paulddraper 10y ago
  There are internet-based patient management systems. Yes, it is possible to explicitly list all certificates you need, or you could simply use the same PK infrastructure as the rest of the world.
- jcrawfordor 10y ago
  Telling people that they cannot 1) have their records management system and 2) have internet access on their computer is simply unrealistic. Basic measures like blocking webmail providers are extremely unpopular with employees and produce huge executive pushback, a whitelist approach to internet access like you propose would just be a total non-starter. Imagine if you yourself worked in that environment, where your computer could only access a few select websites because you have access to restricted information (which you almost certainly do) - I mean, most tech workers I know are deeply upset about not having local admin on their machines. What you're proposing is about a thousand steps more restrictive.
  - cmiles74 10y ago
    People work in much worse conditions everyday. Most everyone I know owns a cell phone that has internet access, people can always use those. I don't think expecting people who access restricted data also using machines that lack internet access is that big a deal.
  - crpatino 10y ago
    > Telling people that they cannot 1) have their records management system and 2) have internet access on their computer is simply unrealistic. I bet 100 years ago it was considered unrealistic to tell white collar employees that they could not bring booze to the office. Today it is a firing offense in most jurisdictions. After all, people are already aware there is a distinction between their professional personna and their private self. They know there are things you do under one identity but not under the other, and viceversa. Merely adding one tiny thing to the list will do little. Sure, executives will push back. I bet they pushed back even harder when accountants told them that "No, you cannot put your stripclub bill into the corporate credit card; and I don't care if it was a business expense, either." That's the meaning of being a professional: telling the higher-ups that there are hard rules (natural or otherwise) that don't give a flying-fuck about their social status. Doctors know it, lawyers know it, accountants know it, but for some reason IT people does not seem able to figure that out. Compensation aside, the social prestige that comes with each of those professions is directly proportional to their ability (and duty) to enforce those standards regardless of what their rich and powerful bosses think about it.
mirimir 10y ago
> there are regulatory compliance issues that force them into running something that can intercept TLS connections. Sure. But they also can't be sharing sensitive data with third parties. And yet many AV/security products can upload samples for analysis.[0] Including Word documents. 0) https://www.av-comparatives.org/wp-content/uploads/2014/04/avc_datasending_2014_en.pdf https://www.av-comparatives.org/wp-content/uploads/2014/04/a...
- jcrawfordor 10y ago
  Vendor NDAs and other compliance measures are in place. This is a standard part of negotiating enterprise licensing in security-sensitive sectors.
  - mirimir 10y ago
    > Vendor NDAs So you're saying that providers just promise not to disclose? What if they screw up? Who's liable?
    - jcrawfordor 10y ago
      The vendor is liable. That's what the NDA is for.
      - mirimir 10y ago
        OK, so I wonder who can negotiate NDAs. Let's say that I'm a freelance developer. Could I get an NDA? And if so, would it cost a lot?
        richardwhiuk 10y ago
        An NDA is meaningless if you have no intention of suing the party that violates the NDA. So you need the legal fees to come up with the NDA and sufficient capital to be able to fund a lawsuit should the other party violate the NDA. Finally, you need to be big enough that the other company is interested in signing an NDA for the business. For a solo developer, this is unlikely to be true.

by zaphar 10y ago

Jonnax 10y ago

Well part of the argument that Google/Mozilla are putting forward is that some software does their man in the middle attack in bad ways that compromise user security. The picture in the article states: Avast 11.7: Advertises DES as a cipher (It's been vulnerable for more than a decade) AVG and Bit Defender: Vulnerable to Logjam and POODLE Kaspersky: Vulnerable to CRIME Net Nanny, KinderGate, CYBERsitter, NOD32, Kaspersky Internet Security (Mac): Doesn't validate certificates.

zaphar 10y ago
Sure but for most of these companies conducting a security audit of their AV solution is very much not something are going to be competent at. The typical auditing companies they might hire for there compliance reasons are also not going to be competent at it. As a result, due to a lack of knowledge and a need to check boxes, they will be choosing AV solutions that lower their security. It's a perfect storm. Especially since many of the ones on the list are considered best in market for these people.
Neil44 10y ago
I can only speak to Eset as it's the only one I am sure about, but it definitely does validate certs. I have screen grabs of validation errors because they were interesting.

fulafel 10y ago

They should just live without HTTPS and not break it for everyone else.

lolc 10y ago
They only break HTTPS for themselves. And not using HTTPS is not an option anymore.
- fulafel 10y ago
  They throw their weight around to get MITM support into browsers, see eg the pinning discussion in another comment.

tonyztan 10y ago

TLS interception is not the problem. Improper implementation of the protocol is. AV / Appliance vendors need to configure their MITM proxies correctly so that they utilize the same protocols and verifications that the browsers have.

KingMob 10y ago
But these devices are rarely updated, so even one that's safe now has no guarantee that it can be kept safe in the future. As a more general issue, TLS interception is a problem. Widespread acceptance of TLS proxying violates the TLS contract, which is that all my communications between a website and my browser are safely encrypted.
- madars 10y ago
  The OP's point is that in some realms the user is forbidden (not by technical means, of course, but by law) from entering into such contracts or, at least, executing them. I completely agree that the current state of affairs is gravely deficient :(
deburo 10y ago
The article is also pointing out that .. "The researchers urge antivirus vendors to stop intercepting HTTPS altogether, since the products already have access to the local filesystem, browser memory, and content loaded over HTTPS" I wonder why they are resorting to TLS interception then. Is it just easier to intercept TLS then inspecting memory? Is it just a lack of perspective?
- WorldMaker 10y ago
  Ease of deployment? At least for corporate interception the answer seems to be just how much easier it is to deploy a central proxy than to make sure that client software is up to date. (Forgetting, conveniently, that you have to update client certificate stores every so often.) Similarly the "it's how we've always done it" defense because companies have used that approach for HTTP for so long they don't want to invest in a new approach now that HTTPS makes it much less viable. As for consumer AV products, I have no idea how they defend that other than "let's have our tentacles in all the pies".

hehheh 10y ago

Should people in those industries have access to the outside web on the computers that have even a smidge of access to data that must be kept private by law? I'd say "no" -- I can't think of a scenario in which a healthcare device needs access to Google or hacker news or whatever. They could just use a whitelist and replace all CAs on the computer with a (set of?) private CA(s) that allow the user to do work on information that requires such security.

paulddraper 10y ago
There are internet-based patient management systems. Yes, it is possible to explicitly list all certificates you need, or you could simply use the same PK infrastructure as the rest of the world.
jcrawfordor 10y ago
Telling people that they cannot 1) have their records management system and 2) have internet access on their computer is simply unrealistic. Basic measures like blocking webmail providers are extremely unpopular with employees and produce huge executive pushback, a whitelist approach to internet access like you propose would just be a total non-starter. Imagine if you yourself worked in that environment, where your computer could only access a few select websites because you have access to restricted information (which you almost certainly do) - I mean, most tech workers I know are deeply upset about not having local admin on their machines. What you're proposing is about a thousand steps more restrictive.
- cmiles74 10y ago
  People work in much worse conditions everyday. Most everyone I know owns a cell phone that has internet access, people can always use those. I don't think expecting people who access restricted data also using machines that lack internet access is that big a deal.
- crpatino 10y ago
  > Telling people that they cannot 1) have their records management system and 2) have internet access on their computer is simply unrealistic. I bet 100 years ago it was considered unrealistic to tell white collar employees that they could not bring booze to the office. Today it is a firing offense in most jurisdictions. After all, people are already aware there is a distinction between their professional personna and their private self. They know there are things you do under one identity but not under the other, and viceversa. Merely adding one tiny thing to the list will do little. Sure, executives will push back. I bet they pushed back even harder when accountants told them that "No, you cannot put your stripclub bill into the corporate credit card; and I don't care if it was a business expense, either." That's the meaning of being a professional: telling the higher-ups that there are hard rules (natural or otherwise) that don't give a flying-fuck about their social status. Doctors know it, lawyers know it, accountants know it, but for some reason IT people does not seem able to figure that out. Compensation aside, the social prestige that comes with each of those professions is directly proportional to their ability (and duty) to enforce those standards regardless of what their rich and powerful bosses think about it.

mirimir 10y ago

> there are regulatory compliance issues that force them into running something that can intercept TLS connections. Sure. But they also can't be sharing sensitive data with third parties. And yet many AV/security products can upload samples for analysis.[0] Including Word documents. 0) https://www.av-comparatives.org/wp-content/uploads/2014/04/avc_datasending_2014_en.pdf https://www.av-comparatives.org/wp-content/uploads/2014/04/a...

jcrawfordor 10y ago
Vendor NDAs and other compliance measures are in place. This is a standard part of negotiating enterprise licensing in security-sensitive sectors.
- mirimir 10y ago
  > Vendor NDAs So you're saying that providers just promise not to disclose? What if they screw up? Who's liable?
  - jcrawfordor 10y ago
    The vendor is liable. That's what the NDA is for.
    - mirimir 10y ago
      OK, so I wonder who can negotiate NDAs. Let's say that I'm a freelance developer. Could I get an NDA? And if so, would it cost a lot?
      - richardwhiuk 10y ago
        An NDA is meaningless if you have no intention of suing the party that violates the NDA. So you need the legal fees to come up with the NDA and sufficient capital to be able to fund a lawsuit should the other party violate the NDA. Finally, you need to be big enough that the other company is interested in signing an NDA for the business. For a solo developer, this is unlikely to be true.