4 ms·

TLS interception is not the problem. Improper implementation of the protocol is. AV / Appliance vendors need to configure their MITM proxies correctly so that t

TLS interception is not the problem. Improper implementation of the protocol is. AV / Appliance vendors need to configure their MITM proxies correctly so that they utilize the same protocols and verifications that the browsers have.

KingMob 10y ago
But these devices are rarely updated, so even one that's safe now has no guarantee that it can be kept safe in the future. As a more general issue, TLS interception is a problem. Widespread acceptance of TLS proxying violates the TLS contract, which is that all my communications between a website and my browser are safely encrypted.
- madars 10y ago
  The OP's point is that in some realms the user is forbidden (not by technical means, of course, but by law) from entering into such contracts or, at least, executing them. I completely agree that the current state of affairs is gravely deficient :(
deburo 10y ago
The article is also pointing out that .. "The researchers urge antivirus vendors to stop intercepting HTTPS altogether, since the products already have access to the local filesystem, browser memory, and content loaded over HTTPS" I wonder why they are resorting to TLS interception then. Is it just easier to intercept TLS then inspecting memory? Is it just a lack of perspective?
- WorldMaker 10y ago
  Ease of deployment? At least for corporate interception the answer seems to be just how much easier it is to deploy a central proxy than to make sure that client software is up to date. (Forgetting, conveniently, that you have to update client certificate stores every so often.) Similarly the "it's how we've always done it" defense because companies have used that approach for HTTP for so long they don't want to invest in a new approach now that HTTPS makes it much less viable. As for consumer AV products, I have no idea how they defend that other than "let's have our tentacles in all the pies".
- emmelaich 10y ago
  Virus checkers can stop intrusion and hence help integrity. They can't (or actually don't) prevent loss of confidentiality. Companies that run these MITM proxies are also protecting against deliberate extrusion of sensitive data.

KingMob 10y ago

But these devices are rarely updated, so even one that's safe now has no guarantee that it can be kept safe in the future. As a more general issue, TLS interception is a problem. Widespread acceptance of TLS proxying violates the TLS contract, which is that all my communications between a website and my browser are safely encrypted.

madars 10y ago
The OP's point is that in some realms the user is forbidden (not by technical means, of course, but by law) from entering into such contracts or, at least, executing them. I completely agree that the current state of affairs is gravely deficient :(

deburo 10y ago

The article is also pointing out that .. "The researchers urge antivirus vendors to stop intercepting HTTPS altogether, since the products already have access to the local filesystem, browser memory, and content loaded over HTTPS" I wonder why they are resorting to TLS interception then. Is it just easier to intercept TLS then inspecting memory? Is it just a lack of perspective?

WorldMaker 10y ago
Ease of deployment? At least for corporate interception the answer seems to be just how much easier it is to deploy a central proxy than to make sure that client software is up to date. (Forgetting, conveniently, that you have to update client certificate stores every so often.) Similarly the "it's how we've always done it" defense because companies have used that approach for HTTP for so long they don't want to invest in a new approach now that HTTPS makes it much less viable. As for consumer AV products, I have no idea how they defend that other than "let's have our tentacles in all the pies".
emmelaich 10y ago
Virus checkers can stop intrusion and hence help integrity. They can't (or actually don't) prevent loss of confidentiality. Companies that run these MITM proxies are also protecting against deliberate extrusion of sensitive data.