8 ms·
The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.
by db48x 10y ago
The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.
- Viper007Bond 10y agoIsn't MITM required in enterprise environments where they want to filter content? Unless you want to run it client-side which isn't usually an option.
- discreditable 10y agoBasic filtering can be done via passively inspecting SNI headers and terminating connections to verboten hosts. However, that's not enough for some orgs, and some software works around it: https://www.bamsoftware.com/papers/fronting/ https://www.bamsoftware.com/papers/fronting/
- ec109685 10y agoEven simple tls handshake filtering is broken with BlueCoat's implementation.
- emmab 10y ago> Isn't MITM required in enterprise environments where they want to filter content? Then don't filter content.
- theluketaylor 10y agoAt my workplace we need to use middleboxes like this for 2 reasons -our commitment to our customers and regulatory compliance requires we know where customer data is at all times. It would be lovely if all employees could be trusted with data at all times, but the reality is some employees will steal information, as google found out with Levandowski. That's google's own information though; they don't have a regulatory requirement to report the breach, whereas the data I protect requires full disclosure legally. -malware is increasingly using https to communicate with C&C. Many malware families now install a trusted root cert so they can exfiltrate data on less monitored 443 rather than 80. When (not if) devices get compromised we need to know what the attacker got. I would love to not need to do this because it's a privacy mess and breaks applications all the time, but there simply are not better tools to serve as the last line of defence against data loss. iOS has mostly solved this problem through a combination of not running unsigned code and APIs where MDM can draw a corporate data barrier inside the phone, but while desktop OSs remain there will need to be some form of this.
- DannyBee 10y agoGreat, as long as the world is black and white and completely susceptible to binarization.
- parennoob 10y agoThere are ways to filter content without breaking user privacy. For example, you could restrict access to the Internet altogether, and suggest that your users only get what they need from your internal corporate network. See how incredibly productive that makes your staff? What these "enterprise environments" want is to leech off the Internet's knowledge while keeping a firm chokehold on the privacy of their own employees Sadly, it looks like Google is caving in to their pressure.
- detaro 10y ago> Sadly, it looks like Google is finally caving in to their pressure. Maybe someone like Mozilla won't. All browser vendors provide the necessary bits for properly implemented HTTPS MITM, and have done so for ages (which are fairly simple, basically "allow local trusted certificate roots and ignore key pinning for them").
- _jal 10y ago> What these "enterprise environments" want is to leech off the Internet's knowledge while keeping a firm chokehold on the privacy of their own employees Because one size really does fit all, and all environments have the same needs?
- zaphar 10y agoIt's my understanding that BlueCoat is used pretty heavily in some schools. Most of the students there don't have the option of "working" somewhere else.
- stonogo 10y agoI'm sure the students of the Montgomery County, Maryland public school system, who are affected by this problem, will take your advice into consideration when submitting resumes to other public schools.
- x1798DE 10y agoThey should lobby the school board not to do this nonsense.
- acdha 10y agoThink about how that conversation would go. They're driven by concerns that kids will look at porn – and remember that if they don't try to stop that, the local Fox News applicate will be running a loop 24x7 saying they're trying to force godly children to watch it – or that someone will breach a staff member's computer and steal PII, compromise the security cameras, etc. Against that, making life hard for Chrome engineers’ aggressive upgrade campaign is pretty hard sell. “Buy a better box” perhaps but I don't see a viable argument for “don't monitor”.
- bgc 10y agoThe Board doesn't have a choice, under CIPA[0], content filtering is a requirement for the FCC's E-Rate program[1] in which the government pays some of the cost of the school's internet connection. [0]https://www.fcc.gov/consumers/guides/childrens-internet-protection-act https://www.fcc.gov/consumers/guides/childrens-internet-prot... [1]https://www.fcc.gov/general/universal-service-program-schools-and-libraries-e-rate https://www.fcc.gov/general/universal-service-program-school...
- johncolanduoni 10y agoThis is legally required in some sectors for regulation purposes, notably finance. I think a lot of people who casually throw out this sentiment don't appreciate that aspect of it.
- hermitdev 10y ago+1. I work in regulatory compliance at a financial firm. My current firm doesn't do this because we don't originate trades, but when I worked at a hedge fund, all forms of electronic communications were MITM'd & recorded for regulatory reasons (and to monitor for IP theft - we did sue a soon former employee after he emailed source for a quantitative model to his personal gmail) primarily to combat or defend against insider trading.
- FireBeyond 10y ago> and to monitor for IP theft - we did sue a soon former employee after he emailed source for a quantitative model to his personal gmail That wouldn't be a certain Sergey Aleynikov and GS would it? (https://en.wikipedia.org/wiki/Sergey_Aleynikov https://en.wikipedia.org/wiki/Sergey_Aleynikov)
- hermitdev 10y agoNo. I've never worked for GS. In the case I'm talking about, the employee was sued 4 hours before he was fired. Federal criminal charges came a few months later.
- marcoperaza 10y agoWithout an SSL MITM, Intrusion Detection Systems (IDS's) are much less effective. If you're using your company's network, then they have every right to monitor all of the activity on it. They're trying to protect trade secrets, future plans, customer data, employee records, etc. from attackers who would use that information to do harm to the company, its customers, and its employees. If you don't want your employer to know what you're doing, then don't use the company computer or company network to do it. And while you may think that you're too tech savvy to fall prey to malware 1) not everyone at your company is, and 2) no amount of savvy will protect you from all malware, especially ones that gain a foothold through an unpatched exploit. And there's also that whole other can of worms: malicious employees.
- ckuehl 10y agoTotally agreed they have the right to monitor your network traffic, but I still think in most cases employees should try to push back on this. At least from my view, it's not so much that I don't want my company to know what I'm doing, as that I don't trust their software to securely MITM all of my traffic. This thread doesn't fill me with confidence about the competency of these corporate MITM proxies. And the recent Cloudflare news doesn't help either -- they're effectively the world's largest MITM proxy, and even they couldn't avoid leaking a huge amount of "secure" traffic. There are surely sectors where it's necessary for a company to MITM all traffic, but I think most companies will do better security-wise by not messing with TLS. It's just too hard to get right.
- theluketaylor 10y agoAt my workplace where we have to do tls inspection for regulatory purposes we provide an internet-only wifi network for employee personal use where we don't intercept TLS. This network is fully isolated from the corporate network and corporate devices join a different, more monitored network. I believe this strikes the best balance between regulatory compliance and employee privacy. People can still use personal email or do online banking while at the office without inspection, but no corporate data can be moved en mass off company servers.
- userbinator 10y agoI MITM my own connections for filtering purposes. It turns out to be the most effective way of blocking and changing crap in not just my main browser (of which I use several), but those embedded in other apps, for phoning home or otherwise.
- riffic 10y agoYes. If I was a sysadmin at an org that ran one of these shit products I'd rather go work someplace else.