4 ms·

Can you describe what is "knee jerk" about HTTPS everywhere? It sounds like you're saying that you believe HTTPS is a bad solution to (presumably) the problem

by __jal 10y ago

Can you describe what is "knee jerk" about HTTPS everywhere? It sounds like you're saying that you believe HTTPS is a bad solution to (presumably) the problem of surveillance-friendly plaintext comms via browser. But I'd like to understand. You also seem to be claiming that AV products are somehow a special category of security product, for which evaluation is especially difficult. I don't see it, and in fact, there's a handy chart in that post to help. Companies that have audit requirements for these things are most likely going to need purpose-built tools for this; depending on AV crapware is a terrible idea. And as for the notion that "most" enterprises should be shoulder-surfing their employees, well. I assume you also recommend all employees pass through a metal detector and have all thumb-drives and whatnot inspected on the way out? If not, why not?

3pt14159 10y ago
Should elementary aged school children have privacy while surfing the internet from school? If the answer to that question is "no" then the answer about HTTPS everywhere can be seen as knee-jerk. Of course, system administrators could put further work into making sure that computers are not used maliciously, for example, by recording the screen constantly and by randomly inspecting the recording or by using machine learning to identify things like pornography, but it won't cover everything (browser bars that are actually malware or other viruses) and it's a whole lot easier to just thwart HTTPS than it is to do anything else.
- fulafel 10y ago
  Yes, of course children should have privacy.
- joncp 10y ago
  Don't forget that HTTPS everywhere is not just about privacy.
- __jal 10y ago
  Your argument is that privacy and security stances for web browsing should be driven by what is appropriate for the 10-and-under crowd?
- jcrawfordor 10y ago
  The situation you describe is a great use case for well-implemented TLS interception. There is absolutely no need to degrade security and privacy for everyone else just to cover this case of individuals in a more restrictive environment.
  - 3pt14159 10y ago
    The question was "why not HTTPS everywhere?" which I've answered. Your rebuttal is "then don't use HTTPS everywhere!" then ok, we're in agreement. Your answer could have also been "doesn't matter, still use HTTPS everywhere!" which I think is also a fine answer if we're also ok with taking certain computers off of the internet, like say the computers that children use at school[1] or computers in charge of medical data, but our choice is one of three things: 1. Give up privacy because our data is easy to leak out through HTTPS traffic, so we'll admit defeat and let our healthcare records leak because we can't MITM the traffic. 2. Give up privacy because we have methods of MITM attacking, including for both good and evil uses. 3. Give up efficiency by removing computers from the internet / other large networks. Personally I think the long run is #3 but I've underestimated humanity's laziness many times. [1] I'm actually 100% ok with this until a certain age, they really don't need more than messaging, typing classes, a math program or three, and Wikipedia.
    - jcrawfordor 10y ago
      TLS interception does not equate to not using HTTPS. Loading a trusted MITM certificate into the trust stores of computers an organization manages is a perfectly valid way to use HTTPS that does not need to compromise the security of HTTPS, even if many products have implemented it poorly.
- nsgi 10y ago
  Yes, they should. They might want to look up information on abuse, sexual health or homosexuality in confidence. There are other ways to accomplish preventing children from accessing inappropriate content, namely filtering by domain which is still possible with HTTPS. Google SafeSearch can also be turned on at the DNS level, still allowing HTTPS to be used and privacy to be maintained. The best way to accomplish more granular filtering is to install a custom browser extension that monitors what pages are visited, no machine learning necessary. And if group policy doesn't prevent browser toolbars from being installed, the school has bigger problems.
  - 3pt14159 10y ago
    You're simultaneously saying that children should have privacy while also saying children should have browser extensions that monitors what pages are being visited.
- scrollaway 10y ago
  > Should elementary aged school children have privacy while surfing the internet from school? Yes... yes they should. What would possess someone to say they shouldn't? If this is about parental controls, it's a non-issue, as someone else explained. You can have both privacy and parental controls.
- solatic 10y ago
  > to identify things like pornography You do understand that: a) nobody has come up with an algorithm that can visually identify pornography? Hell, how can we come up with an algorithm when we have such trouble even legally defining pornography? https://en.wikipedia.org/wiki/I_know_it_when_I_see_it https://en.wikipedia.org/wiki/I_know_it_when_I_see_it b) TLS doesn't mask the source/destination IP's, just the content, and as such pornographic sites can still be filtered and banned in school environments without attacking TLS. ... right?
  - 3pt14159 10y ago
    Of course I realize that TLS doesn't mask that. It doesn't matter though because https://reddit.com/r/nsfw https://reddit.com/r/nsfw or https://imgur.com/hotaction.jpg https://imgur.com/hotaction.jpg are both shrouded by HTTPS. Also, plenty of people have come up with algorithms that are very reliable (highly performant ROC curves) at identifying pornography. Certainly reliable enough for whatever pornography today's children are searching for on school computers.
Spooky23 10y ago
Should your therapists secretary, who has access to your medical records and your therapists notes be able to pick up malware from some drive by page and be able to exfiltrate your data without any audit trail or inspection? Should a administrative person at your local police department be able to take screenshots of a criminal complaint where someone wrongfully alleges that you have commited some horrific crime and post them to Facebook or save to their Dropbox? You have a duty to protect your customers. In my career, I've had to testify as a witness when employees attempted to steal customer identities by various means. They were caught because our outbound DLP/proxy identified structured data that matched records commonly in use. I don't claim that AV is special. I do claim that evaluating the quality of an HTTPS implementation inside of AV software is difficult, particularly for customers (typically SMB, schools, or municipal government) who are looking at client based solutions. If you're in a position of leadership in a company that may be handling my data, please let me know so that I can do business elsewhere.
- fulafel 10y ago
  Do you realize what controls "Should person X be able to do Y" implies? We don't live in a surveillance state where we control people by all encompassing surveillance. This is the status quo, and there's a consensus to keep it that way. Even in the US where employer snooping is largely unregulated, people are still left with more than enough capability to exfiltrate information from their organisations. Changing that would imply twice-daily pat-downs / cavity searches, inability to exit the workplace for lunch, bans of personal smartphone etc devices, regular home searches, wiretapping of personal phone/im/email etc and it would still be leaky. I'm sure you can find instances of leaks where they happened through channels that your "DLP" product has caught, and I can see how that works as a marketing point for DLP. But in the big picture the problem isn't "TLS is secure" and outbound traffic snooping doesn't solve it.
kasabali 10y ago
> Companies that have audit requirements for these things are most likely going to need purpose-built tools for this; depending on AV crapware is a terrible idea. Good luck for them. FTA: > They also find that the default settings on 11 of 12 network appliances tested introduce severe flaws, such as incorrectly validating certificates, while 24 of 26 antivirus products introduce one or more security flaws. ... > Similarly on the appliance side, only Blue Coat's ProxySG 6642 scored an A. Others products are from A10, Barracuda, Checkpoint, Cisco, Forcepoint Websense, Fortinet, Juniper, Microsoft, Sophos, Untangle, and WebTitan.

by __jal 10y ago

3pt14159 10y ago

Should elementary aged school children have privacy while surfing the internet from school? If the answer to that question is "no" then the answer about HTTPS everywhere can be seen as knee-jerk. Of course, system administrators could put further work into making sure that computers are not used maliciously, for example, by recording the screen constantly and by randomly inspecting the recording or by using machine learning to identify things like pornography, but it won't cover everything (browser bars that are actually malware or other viruses) and it's a whole lot easier to just thwart HTTPS than it is to do anything else.

fulafel 10y ago
Yes, of course children should have privacy.
joncp 10y ago
Don't forget that HTTPS everywhere is not just about privacy.
__jal 10y ago
Your argument is that privacy and security stances for web browsing should be driven by what is appropriate for the 10-and-under crowd?
jcrawfordor 10y ago
The situation you describe is a great use case for well-implemented TLS interception. There is absolutely no need to degrade security and privacy for everyone else just to cover this case of individuals in a more restrictive environment.
- 3pt14159 10y ago
  The question was "why not HTTPS everywhere?" which I've answered. Your rebuttal is "then don't use HTTPS everywhere!" then ok, we're in agreement. Your answer could have also been "doesn't matter, still use HTTPS everywhere!" which I think is also a fine answer if we're also ok with taking certain computers off of the internet, like say the computers that children use at school[1] or computers in charge of medical data, but our choice is one of three things: 1. Give up privacy because our data is easy to leak out through HTTPS traffic, so we'll admit defeat and let our healthcare records leak because we can't MITM the traffic. 2. Give up privacy because we have methods of MITM attacking, including for both good and evil uses. 3. Give up efficiency by removing computers from the internet / other large networks. Personally I think the long run is #3 but I've underestimated humanity's laziness many times. [1] I'm actually 100% ok with this until a certain age, they really don't need more than messaging, typing classes, a math program or three, and Wikipedia.
  - jcrawfordor 10y ago
    TLS interception does not equate to not using HTTPS. Loading a trusted MITM certificate into the trust stores of computers an organization manages is a perfectly valid way to use HTTPS that does not need to compromise the security of HTTPS, even if many products have implemented it poorly.
nsgi 10y ago
Yes, they should. They might want to look up information on abuse, sexual health or homosexuality in confidence. There are other ways to accomplish preventing children from accessing inappropriate content, namely filtering by domain which is still possible with HTTPS. Google SafeSearch can also be turned on at the DNS level, still allowing HTTPS to be used and privacy to be maintained. The best way to accomplish more granular filtering is to install a custom browser extension that monitors what pages are visited, no machine learning necessary. And if group policy doesn't prevent browser toolbars from being installed, the school has bigger problems.
- 3pt14159 10y ago
  You're simultaneously saying that children should have privacy while also saying children should have browser extensions that monitors what pages are being visited.
scrollaway 10y ago
> Should elementary aged school children have privacy while surfing the internet from school? Yes... yes they should. What would possess someone to say they shouldn't? If this is about parental controls, it's a non-issue, as someone else explained. You can have both privacy and parental controls.
solatic 10y ago
> to identify things like pornography You do understand that: a) nobody has come up with an algorithm that can visually identify pornography? Hell, how can we come up with an algorithm when we have such trouble even legally defining pornography? https://en.wikipedia.org/wiki/I_know_it_when_I_see_it https://en.wikipedia.org/wiki/I_know_it_when_I_see_it b) TLS doesn't mask the source/destination IP's, just the content, and as such pornographic sites can still be filtered and banned in school environments without attacking TLS. ... right?
- 3pt14159 10y ago
  Of course I realize that TLS doesn't mask that. It doesn't matter though because https://reddit.com/r/nsfw https://reddit.com/r/nsfw or https://imgur.com/hotaction.jpg https://imgur.com/hotaction.jpg are both shrouded by HTTPS. Also, plenty of people have come up with algorithms that are very reliable (highly performant ROC curves) at identifying pornography. Certainly reliable enough for whatever pornography today's children are searching for on school computers.

Spooky23 10y ago

Should your therapists secretary, who has access to your medical records and your therapists notes be able to pick up malware from some drive by page and be able to exfiltrate your data without any audit trail or inspection? Should a administrative person at your local police department be able to take screenshots of a criminal complaint where someone wrongfully alleges that you have commited some horrific crime and post them to Facebook or save to their Dropbox? You have a duty to protect your customers. In my career, I've had to testify as a witness when employees attempted to steal customer identities by various means. They were caught because our outbound DLP/proxy identified structured data that matched records commonly in use. I don't claim that AV is special. I do claim that evaluating the quality of an HTTPS implementation inside of AV software is difficult, particularly for customers (typically SMB, schools, or municipal government) who are looking at client based solutions. If you're in a position of leadership in a company that may be handling my data, please let me know so that I can do business elsewhere.

fulafel 10y ago
Do you realize what controls "Should person X be able to do Y" implies? We don't live in a surveillance state where we control people by all encompassing surveillance. This is the status quo, and there's a consensus to keep it that way. Even in the US where employer snooping is largely unregulated, people are still left with more than enough capability to exfiltrate information from their organisations. Changing that would imply twice-daily pat-downs / cavity searches, inability to exit the workplace for lunch, bans of personal smartphone etc devices, regular home searches, wiretapping of personal phone/im/email etc and it would still be leaky. I'm sure you can find instances of leaks where they happened through channels that your "DLP" product has caught, and I can see how that works as a marketing point for DLP. But in the big picture the problem isn't "TLS is secure" and outbound traffic snooping doesn't solve it.

kasabali 10y ago

> Companies that have audit requirements for these things are most likely going to need purpose-built tools for this; depending on AV crapware is a terrible idea. Good luck for them. FTA: > They also find that the default settings on 11 of 12 network appliances tested introduce severe flaws, such as incorrectly validating certificates, while 24 of 26 antivirus products introduce one or more security flaws. ... > Similarly on the appliance side, only Blue Coat's ProxySG 6642 scored an A. Others products are from A10, Barracuda, Checkpoint, Cisco, Forcepoint Websense, Fortinet, Juniper, Microsoft, Sophos, Untangle, and WebTitan.