5 ms·

Random (no pun intended) thought after reading this: how much of the supposedly secure HTTPS/TLS traffic is terminated by hardware load balancers and such that

by gcp 9y ago

Random (no pun intended) thought after reading this: how much of the supposedly secure HTTPS/TLS traffic is terminated by hardware load balancers and such that aren't really open and might have similar vulnerabilities?

hannob 9y ago
It's a huge chunk and it's an underappreciated problem. Many appliance vendors have terrible self-made TLS stacks. There's a bunch of vendors whose names come up again and again when talking about stupid TLS bugs and vulnerabilities. Cisco, F5, Cavium, A10, Citrix, Fortinet are names that come to mind. And it's not only a problem for security, it's also a huge compatibility problem, as they tend to violate the protocol in ways that makes deploying new features and versions hard. I've once given a talk where I tried to highlight this: https://www.youtube.com/watch?v=w3Sn5kMPzVA https://www.youtube.com/watch?v=w3Sn5kMPzVA (slides unfortunately not in the video, but here https://int21.de/slides/auscert-tls/ https://int21.de/slides/auscert-tls/ )
- philippnagel 9y ago
  Are there any "solid" vendors?
blfr 9y ago
I will make the opposite bet to sibling comment and say not too much. It's too easy to just install nginx and let it terminate connections to bother with a hardware device that you have to buy, store, and maintain. And many sites use CDNs or cloud services for connection termination. Cloudflare and Amazon are surely on top of these things.
- marcosdumay 9y ago
  People buy those devices for the throughput. Bigger sites are more likely to have them than smaller ones.
- acdha 9y ago
  This is true of small shops and cloud operations but every enterprise IT shop I’ve seen has a router geek who is convinced you need an appliance to terminate traffic, even if it’s a decelerator in practice.
- gcp 9y ago
  So we're hoping CloudFlare and Amazon don't have such bugs? (Ignoring the fact that it was already demonstrated at least once that they in fact do...)

by gcp 9y ago

hannob 9y ago

It's a huge chunk and it's an underappreciated problem. Many appliance vendors have terrible self-made TLS stacks. There's a bunch of vendors whose names come up again and again when talking about stupid TLS bugs and vulnerabilities. Cisco, F5, Cavium, A10, Citrix, Fortinet are names that come to mind. And it's not only a problem for security, it's also a huge compatibility problem, as they tend to violate the protocol in ways that makes deploying new features and versions hard. I've once given a talk where I tried to highlight this: https://www.youtube.com/watch?v=w3Sn5kMPzVA https://www.youtube.com/watch?v=w3Sn5kMPzVA (slides unfortunately not in the video, but here https://int21.de/slides/auscert-tls/ https://int21.de/slides/auscert-tls/ )

philippnagel 9y ago
Are there any "solid" vendors?

blfr 9y ago

I will make the opposite bet to sibling comment and say not too much. It's too easy to just install nginx and let it terminate connections to bother with a hardware device that you have to buy, store, and maintain. And many sites use CDNs or cloud services for connection termination. Cloudflare and Amazon are surely on top of these things.

marcosdumay 9y ago
People buy those devices for the throughput. Bigger sites are more likely to have them than smaller ones.
acdha 9y ago
This is true of small shops and cloud operations but every enterprise IT shop I’ve seen has a router geek who is convinced you need an appliance to terminate traffic, even if it’s a decelerator in practice.
gcp 9y ago
So we're hoping CloudFlare and Amazon don't have such bugs? (Ignoring the fact that it was already demonstrated at least once that they in fact do...)