4 ms·

I don't think that's the correct interpretation of this document. A better title would be "Most TLS Proxies Considered Harmful", not TLS interception as a whole

I don't think that's the correct interpretation of this document. A better title would be "Most TLS Proxies Considered Harmful", not TLS interception as a whole. US-CERT is explicitly calling out that many appliances and applications often are weakening security vs. the common TLS clients, by way of not properly validating certificate chains by proxy for the client and otherwise masking SSL/TLS issues from being surfaced to the end user. I believe this is CERT trying to get software companies to get their act together on solving security-detrimental UX/UI issues vs. a blanket statement not to add TLS interception proxies to a corporate network.

hannob 10y ago
> I don't think that's the correct interpretation of this document. A better title would be "Most TLS Proxies Considered Harmful", not TLS interception as a whole. This is the usual reaction to this I see everywhere. It doesn't match with reality. Read the complete paper by Halderman et al [1]. It says pretty clearly that all existing products lower the security in one way or another: "Our grading scale focuses on the security of the TLS handshake and does not account for the additional HTTPS validation checks present in many browsers, such as HSTS, HPKP, OneCRL/CRLSets, certificate transparency validation, and OCSP must-staple. None of the products we tested supported these features." TLS Interception that doesn't degrade security is a myth that exists only in some parallel world fantasy. It's also not very surprising. Browser vendors have extremely qualified security teams that are involved in many ways in the development of stronger TLS protections. Nothing like that can be said about any of the vendors of interception products. [1] https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf
- mathw 10y ago
  Is better TLS interception actually possible? Is it just that it's usually badly implemented, or is it a fundamental weakening? Other than the unavoidable weakening of having another system seeing the unencrypted data, which is inherent in using one of these systems and can never go away.
  - hannob 10y ago
    > Is better TLS interception actually possible? Is it just that it's usually badly implemented, or is it a fundamental weakening? In theory, yes, apart from the obvious "more attack surface" problem. They could check for HPKP, CRLset, CT. They could even do more. (CT checking is very basic in Chrome and nonexistent in other browsers.) However in reality? No. In the real world Bluecoat manages to break TLS 1.3 deployment, although its designers tried everything to avoid that and they have been asked by Google to test that.

hannob 10y ago

> I don't think that's the correct interpretation of this document. A better title would be "Most TLS Proxies Considered Harmful", not TLS interception as a whole. This is the usual reaction to this I see everywhere. It doesn't match with reality. Read the complete paper by Halderman et al [1]. It says pretty clearly that all existing products lower the security in one way or another: "Our grading scale focuses on the security of the TLS handshake and does not account for the additional HTTPS validation checks present in many browsers, such as HSTS, HPKP, OneCRL/CRLSets, certificate transparency validation, and OCSP must-staple. None of the products we tested supported these features." TLS Interception that doesn't degrade security is a myth that exists only in some parallel world fantasy. It's also not very surprising. Browser vendors have extremely qualified security teams that are involved in many ways in the development of stronger TLS protections. Nothing like that can be said about any of the vendors of interception products. [1] https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf

mathw 10y ago
Is better TLS interception actually possible? Is it just that it's usually badly implemented, or is it a fundamental weakening? Other than the unavoidable weakening of having another system seeing the unencrypted data, which is inherent in using one of these systems and can never go away.
- hannob 10y ago
  > Is better TLS interception actually possible? Is it just that it's usually badly implemented, or is it a fundamental weakening? In theory, yes, apart from the obvious "more attack surface" problem. They could check for HPKP, CRLset, CT. They could even do more. (CT checking is very basic in Chrome and nonexistent in other browsers.) However in reality? No. In the real world Bluecoat manages to break TLS 1.3 deployment, although its designers tried everything to avoid that and they have been asked by Google to test that.