3 ms·

Is better TLS interception actually possible? Is it just that it's usually badly implemented, or is it a fundamental weakening? Other than the unavoidable weak

by mathw 10y ago

Is better TLS interception actually possible? Is it just that it's usually badly implemented, or is it a fundamental weakening? Other than the unavoidable weakening of having another system seeing the unencrypted data, which is inherent in using one of these systems and can never go away.

hannob 10y ago
> Is better TLS interception actually possible? Is it just that it's usually badly implemented, or is it a fundamental weakening? In theory, yes, apart from the obvious "more attack surface" problem. They could check for HPKP, CRLset, CT. They could even do more. (CT checking is very basic in Chrome and nonexistent in other browsers.) However in reality? No. In the real world Bluecoat manages to break TLS 1.3 deployment, although its designers tried everything to avoid that and they have been asked by Google to test that.