3 ms·
Having worked in locked down networks before, I get the idea of securing resources and keeping secure data inside the network. But what bothers me, is I keep a
by bb88 9y ago
Having worked in locked down networks before, I get the idea of securing resources and keeping secure data inside the network.
But what bothers me, is I keep asking myself the question: When and why did we decide to give the proxy all the power in this relationship?
If we have to use proxies, at least the proxy should be transparent about itself to all parties on the connection. Then my bank can drop the connection or restrict functions/data to non-proxied data, secure government servers can drop the connection, my browser can drop the connection and give me an error (because I don't want anyone snooping on my banking history), etc.
Eg. Let's say I open the patient portal for my hospital through a proxy. Is the proxy software HIPAA compliant? What about the people that have access to my health data through the proxy software? In this case, I would think we should allow the portal software to drop the connection because the connection itself is not secure.
- cesarb 9y ago> In this case, I would think we should allow the portal software to drop the connection because the connection itself is not secure. It sounds like what you want is the server authenticating the client. That already exists in TLS: it's called a client certificate (complementing the usual server certificate, which authenticates the server to the client). Unless the MITM proxy has access to the client certificate's private key, or the server trusts the MITM proxy's CA, the proxy cannot impersonate the client.
- sitepodmatt 9y agoIs any B2C mainstream bank using client certificates? I've not seen it in the wild. I think easier solution is just BYOD to work with 3g/4g SIM, you can pick up a reasonable 8" tablet for $100 that supplements your phone for when you need a bigger screen size.
- cpach 9y ago”Is any B2C mainstream bank using client certificates?” I doubt it. AFAIK the web browsers’ UI for handling client certificates is way too cumbersome for mainstream usage.
- tialaramex 9y agoOne of the nice things in TLS 1.3 that we might never end up using in anger but is there if we want it is the request from a server for a client certificate now gets to express arbitrary constraints. In TLS 1.2 you could only express a list of CAs whose signatures you trust (this is one of the most widely misconfigured settings in OpenSSL-based software, telling OpenSSL you _trust_ some CA to identify clients when actually you meant to say your server certificate is _signed_ by that CA) In TLS 1.3 you can write out arbitrary constraints, although somebody will need to define any new ones in a separate ID or RFC. So this might simplify the end user experience down the road because the browser can do enough matching to just hand over the correct certificate automatically. Or it might never get used on the public Internet, oh well.
- bb88 9y agoThe point I was really making was one about transparency. Many people don't know their connection is insecure. They see the green link status on chrome and everything is good. If the server detects an insecure connection, then at least the minimum is that the user is informed.