5 ms·
> There is a strong argument that in the financial-institution case you should be just blocking web-bound TLS traffic There is a simpler solution to let users
by espadrine 9y ago
> There is a strong argument that in the financial-institution case you should be just blocking web-bound TLS traffic
There is a simpler solution to let users still access the Web: let them do so unencrypted. They won't have the "Secure" symbol on their browser, which is extremely reasonable considering that, indeed, their access is not really secure: their employer can read all communications.
The employer simply sets up a proxy that receives unencrypted communications and encrypts them on the fly; a TLS/HTTP client.
- icebraining 9y agoI think that would probably break a lot of web apps, which will use URLs with "https://" https://" in them. Also e.g. HTTP2 doesn't work without TLS (the spec technically allows, but no major browser actually does).
- espadrine 9y agoThe proxy would redirect HTTPS requests to HTTP, and use HTTP 1.1 between the client and the proxy. The bigger issue is HSTS; the proxy can remove the header, but if the origin comes preloaded in the browser, that won't do, which means the browser would need to be customized to not have or enforce HSTS.
- icebraining 9y agoI guess that would be possible, although HTTP2 has some extra features like Server Push, which might be hard to "backport" cleanly.