4 ms·

There was a paper posted on HN a few weeks back by some pretty serious security researchers on the security risks of SSL MITM boxes. https://jhalderm.com/pub/p

There was a paper posted on HN a few weeks back by some pretty serious security researchers on the security risks of SSL MITM boxes. https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf How do you fix this when you're naught but a humble employee? Well, a friend of mine worked at a fairly large tech company where a salesguy for these boxes had convinced the CTO they had to have them. Every tech-person "on the floor" hated the idea, so before the boxes were installed they conspired on their free time to write some scripts that ran lots of legitimate HTTPS traffic, effectively DDOSing the boxes and bringing the company's internet to a crawl for the day, like Google would take ten seconds to open. Then obviously everyone (including the non-tech people) started calling the IT helpdesk complaining that the internet was broken. MITM box salesguy then had to come up with a revised solution, costing 20x more than his first offer, and that was the end of that. If you already are suffering under MITM boxes, a similar strategy with a slow ramp-up in traffic might work.

adrianN 10y ago
It might backfire and your company forbids HTTPS "so that employees can't disclose company secrets without IT having traceability".
- ptaipale 10y ago
  They can't, really. So much of the Web has fortunately moved to HTTPS that then they should just forget about Web access.
- trome 10y ago
  Uhh, what do you do for sites that don't offer HTTP? Many sites force a 301 redirect when hit on HTTP, and won't downgrade.
  - adrianN 10y ago
    Open a ticket with IT?
  - Elhana 10y ago
    Same thing I did when I noticed our bluecoat started mitm-ing my bank connection - ticket to IT to enable bypass for specific domain. They refused to do it for google/gmail, but banking sites start working normally on the next day. Youtube, facebook and other non work related stuff is just blocked, unless you need them to do your job (like PR dept).
    - jessaustin 10y ago
      Of course, for many people gmail would be a key to every door, via password resets.
- Jonnax 10y ago
  The internet has changed significantly over the last few years and a lot of sites don't support unencrypted connections. It's pretty entertaining to read this stack overflow questions about using ssl from 7 years ago: http://stackoverflow.com/questions/2177159/should-all-sites-use-ssl-by-default http://stackoverflow.com/questions/2177159/should-all-sites-...
cm2187 10y ago
Yeah. This is a firable offense. The solution to your company MITM your traffic is not to use your work computer for anything personal that matters. It's not like if we had a shortage of devices to connect to the internet.
- ocdtrekkie 10y ago
  Kinda amazed you got downvoted for pointing out that the parent is essentially advocating for intentionally trying to take down your employer's network because you dislike their IT policy. This isn't just a fireable offense. Especially given the tendency for computer-related criminal laws to be overly vague, it's entirely possible you could be charged with a crime if you are intentionally trying to DoS your employer's network.
- semi-extrinsic 10y ago
  If you live in a third-world country (or the US) which lacks basic functions of society like employee protection, a sensible minimum wage, universal healthcare, paid parental leave, etc., then yes, I don't recommend doing what my friend did with employing a little "civil disobedience" in such cases. TBH, for most techies I don't think opposition to MITM boxes comes down to "I don't want them to catch me looking at cat photos" but more along the lines of "this will actually reduce security as much as it improves it, and the companies providing these products are also aiding repressive regimes and human rights violations across the globe". Personally, I would find it unethical for the company I work for to buy these products.
  - jamespo 10y ago
    What countries can you DoS your employers' network in?
  - Anderkent 10y ago
    > Personally, I would find it unethical for the company I work for to buy these products. Then leave the company in protest or convince it not to buy them. DDoSing the company's network is somehow not unethical, I guess?

adrianN 10y ago

It might backfire and your company forbids HTTPS "so that employees can't disclose company secrets without IT having traceability".

ptaipale 10y ago
They can't, really. So much of the Web has fortunately moved to HTTPS that then they should just forget about Web access.
trome 10y ago
Uhh, what do you do for sites that don't offer HTTP? Many sites force a 301 redirect when hit on HTTP, and won't downgrade.
- adrianN 10y ago
  Open a ticket with IT?
- Elhana 10y ago
  Same thing I did when I noticed our bluecoat started mitm-ing my bank connection - ticket to IT to enable bypass for specific domain. They refused to do it for google/gmail, but banking sites start working normally on the next day. Youtube, facebook and other non work related stuff is just blocked, unless you need them to do your job (like PR dept).
  - jessaustin 10y ago
    Of course, for many people gmail would be a key to every door, via password resets.
Jonnax 10y ago
The internet has changed significantly over the last few years and a lot of sites don't support unencrypted connections. It's pretty entertaining to read this stack overflow questions about using ssl from 7 years ago: http://stackoverflow.com/questions/2177159/should-all-sites-use-ssl-by-default http://stackoverflow.com/questions/2177159/should-all-sites-...

cm2187 10y ago

Yeah. This is a firable offense. The solution to your company MITM your traffic is not to use your work computer for anything personal that matters. It's not like if we had a shortage of devices to connect to the internet.

ocdtrekkie 10y ago
Kinda amazed you got downvoted for pointing out that the parent is essentially advocating for intentionally trying to take down your employer's network because you dislike their IT policy. This isn't just a fireable offense. Especially given the tendency for computer-related criminal laws to be overly vague, it's entirely possible you could be charged with a crime if you are intentionally trying to DoS your employer's network.
semi-extrinsic 10y ago
If you live in a third-world country (or the US) which lacks basic functions of society like employee protection, a sensible minimum wage, universal healthcare, paid parental leave, etc., then yes, I don't recommend doing what my friend did with employing a little "civil disobedience" in such cases. TBH, for most techies I don't think opposition to MITM boxes comes down to "I don't want them to catch me looking at cat photos" but more along the lines of "this will actually reduce security as much as it improves it, and the companies providing these products are also aiding repressive regimes and human rights violations across the globe". Personally, I would find it unethical for the company I work for to buy these products.
- jamespo 10y ago
  What countries can you DoS your employers' network in?
- Anderkent 10y ago
  > Personally, I would find it unethical for the company I work for to buy these products. Then leave the company in protest or convince it not to buy them. DDoSing the company's network is somehow not unethical, I guess?