3 ms·

You can still track employees' e.g. web traffic by installing a CA and proxying their connections. That is what is done today and PFS does not change it.

martinald 9y ago
Not if the website uses CA pinning though?
- detaro 9y ago
  Additionally installed CA certificates override key pinning, for exactly this use case (at least in the major browsers, it's possible some niche ones don't do this)
  - cesarb 9y ago
    The right question would be "Not if the website uses client certificates though?". As far as I know, TLS connections using client certificates can't be proxied, since the MITM proxy would need to have the client certificate's private key.
AndyMcConachie 9y ago
People bring their own devices to work these days. And look, this is not something that I fundamentally agree with or anything. I just want to make sure we understand the arguments of both sides.
- jjawssd 9y ago
  Corporate CA certs still work with BYOD. As of Android 4.0 user trusted certificates can be managed on the Android device in the Settings -> Security -> Certificates -> 'User'-section. Additionally, when using user trusted certificates, Android will force the user of the Android device to implement additional safety measures: the use of a PIN-code, a pattern-lock or a password to unlock the device are mandatory when user-supplied certificates are used. I am sure iOS has a similar method.
- bcoates 9y ago
  If people can BYOD they can bring an LTE connection with it. At that point you should probably stop pretending that monitoring is going to be feasible.
- MichaelGG 9y ago
  BYOD doesn't affect this. If you're on your own device and you connect to Google.com via the company's network, PFS or not, the workplace can't intercept. You'll either get blocked (not using their proxy), or get a CA error (their MITM system can't trick your phone into thinking their self-issued cert is valid). This is true with or without PFS. You'll still have to install the workplace's CA, and then they'll continue to MITM you, like they do today. Or, just use your cell connection and bypass it all. It'd only change if you're connecting to sites the workplace controls and has the private keys for, that you trust (i.e., they get a cert issues by Digicert then disable PFS on their webserver). This isn't what enterprises are upset about.
fulafel 9y ago
And this is still quite questionable, we should not be enabling it.

martinald 9y ago

Not if the website uses CA pinning though?

detaro 9y ago
Additionally installed CA certificates override key pinning, for exactly this use case (at least in the major browsers, it's possible some niche ones don't do this)
- cesarb 9y ago
  The right question would be "Not if the website uses client certificates though?". As far as I know, TLS connections using client certificates can't be proxied, since the MITM proxy would need to have the client certificate's private key.

AndyMcConachie 9y ago

People bring their own devices to work these days. And look, this is not something that I fundamentally agree with or anything. I just want to make sure we understand the arguments of both sides.

jjawssd 9y ago
Corporate CA certs still work with BYOD. As of Android 4.0 user trusted certificates can be managed on the Android device in the Settings -> Security -> Certificates -> 'User'-section. Additionally, when using user trusted certificates, Android will force the user of the Android device to implement additional safety measures: the use of a PIN-code, a pattern-lock or a password to unlock the device are mandatory when user-supplied certificates are used. I am sure iOS has a similar method.
bcoates 9y ago
If people can BYOD they can bring an LTE connection with it. At that point you should probably stop pretending that monitoring is going to be feasible.
MichaelGG 9y ago
BYOD doesn't affect this. If you're on your own device and you connect to Google.com via the company's network, PFS or not, the workplace can't intercept. You'll either get blocked (not using their proxy), or get a CA error (their MITM system can't trick your phone into thinking their self-issued cert is valid). This is true with or without PFS. You'll still have to install the workplace's CA, and then they'll continue to MITM you, like they do today. Or, just use your cell connection and bypass it all. It'd only change if you're connecting to sites the workplace controls and has the private keys for, that you trust (i.e., they get a cert issues by Digicert then disable PFS on their webserver). This isn't what enterprises are upset about.

fulafel 9y ago

And this is still quite questionable, we should not be enabling it.