3 ms·

BRB, telling the compliance team that SSL inspection is morally indefensible. I'm sure they'll be happy to turn it off.

geofft 8y ago
"We should continue doing immoral things because there's no way we'll ever convince corporate and governmental power to let us stop doing immoral things" is ... probably not an incorrect argument, but a very sad one.
- tptacek 8y ago
  SSL inspection isn't immoral. That's an uncharacteristically silly argument.
  - geofft 8y ago
    It's a tool, but it is (in a small way) a normalization of mass surveillance. (I guess I should clarify that my argument is not "SSL inspection is bad and therefore TLS 1.3 is bad" - my employer monitors all my SSL traffic from work-owned machines, and could do so very easily with a browser extension or something instead of SSL inspection if the protocol somehow made middleboxes difficult. The proxies are currently designed to permit a few websites through without interception, which is the specific thing that there was debate about doing, but I don't think there's any real reason why my employer wouldn't just monitor everything if they had to. So I don't think there's anything the TLS spec could have done to make my employer more or less likely to monitor traffic, and I don't think that this affects the argument about whether the monitoring itself is immoral.)
    - unethical_ban 8y ago
      A company monitoring its assets for proper use and the SECURITY and PRIVACY of its customers is not immoral. A browser extension would not do nearly what a proper web proxy can do. I am a critic of the surveillance state and a donating member of the EFF, but web proxies are not evil in themselves, anymore than a camera is evil because it can be used to build a panopticon, or cookies are evil because they can be used for cross site tracking.
      - tptacek 8y ago
        This is approximately where I land on this. The privacy of employees takes a back seat, way in the back, behind the luggage, to the privacy of the information customers vouchsafe with the company. So, I'm always a bit itchy about moralizing against employee surveillance (in technology I mean, not, like, whether Walmart shift workers take too many breaks!).
        dwheeler 8y ago
        The "middlebox problem" being discussed isn't the ability to install CAs on clients - the problem is that middleboxes don't implement the spec properly and prevent upgrading the protocol in the obvious way. I'm not a big fan of transparent proxies, but in the case of employers there's at least a reasonable argument that the "computers are not the user's, they are the company's". There is NO good argument for middleboxes that don't implement the specification correctly and thus make it very hard to upgrade protocols.
        tptacek 8y ago
        Whoah, sorry, don't get me wrong: TLS 1.3 and the eradication of RSA is an unalloyed good thing, and broken middleboxes are bad.
        tialaramex 8y ago
        TLS 1.3 doesn't eradicate RSA it just says you mustn't use it for key agreement. I'm guessing you knew that but just to be clear for anyone else reading. If your focus is getting rid of RSA entirely actually TLS 1.3 may even allow it to stick around a bit longer by reducing how nervous we are about it. If you care primarily about Forward Secrecy then sure, problem fixed.
        wolf550e 8y ago
        'tptacek meant "RSA ciphersuites", not "RSA trapdoor function". The cipher suites that begin with TLS_RSA_* and used RSA encryption to pass key material from client to server, encrypted with the server's long term key (the key from the certificate).
snvzz 8y ago
Let them spend money on new middleboxes, if they care so much.
snvzz 8y ago
>I'm sure they'll be happy to turn it off. They'd turn it off if the alternative was to be offline because the middlebox crashes a second after power on.

"We should continue doing immoral things because there's no way we'll ever convince corporate and governmental power to let us stop doing immoral things" is ... probably not an incorrect argument, but a very sad one.

tptacek 8y ago
SSL inspection isn't immoral. That's an uncharacteristically silly argument.
- geofft 8y ago
  It's a tool, but it is (in a small way) a normalization of mass surveillance. (I guess I should clarify that my argument is not "SSL inspection is bad and therefore TLS 1.3 is bad" - my employer monitors all my SSL traffic from work-owned machines, and could do so very easily with a browser extension or something instead of SSL inspection if the protocol somehow made middleboxes difficult. The proxies are currently designed to permit a few websites through without interception, which is the specific thing that there was debate about doing, but I don't think there's any real reason why my employer wouldn't just monitor everything if they had to. So I don't think there's anything the TLS spec could have done to make my employer more or less likely to monitor traffic, and I don't think that this affects the argument about whether the monitoring itself is immoral.)
  - unethical_ban 8y ago
    A company monitoring its assets for proper use and the SECURITY and PRIVACY of its customers is not immoral. A browser extension would not do nearly what a proper web proxy can do. I am a critic of the surveillance state and a donating member of the EFF, but web proxies are not evil in themselves, anymore than a camera is evil because it can be used to build a panopticon, or cookies are evil because they can be used for cross site tracking.
    - tptacek 8y ago
      This is approximately where I land on this. The privacy of employees takes a back seat, way in the back, behind the luggage, to the privacy of the information customers vouchsafe with the company. So, I'm always a bit itchy about moralizing against employee surveillance (in technology I mean, not, like, whether Walmart shift workers take too many breaks!).
      - dwheeler 8y ago
        The "middlebox problem" being discussed isn't the ability to install CAs on clients - the problem is that middleboxes don't implement the spec properly and prevent upgrading the protocol in the obvious way. I'm not a big fan of transparent proxies, but in the case of employers there's at least a reasonable argument that the "computers are not the user's, they are the company's". There is NO good argument for middleboxes that don't implement the specification correctly and thus make it very hard to upgrade protocols.
        tptacek 8y ago
        Whoah, sorry, don't get me wrong: TLS 1.3 and the eradication of RSA is an unalloyed good thing, and broken middleboxes are bad.
        tialaramex 8y ago
        TLS 1.3 doesn't eradicate RSA it just says you mustn't use it for key agreement. I'm guessing you knew that but just to be clear for anyone else reading. If your focus is getting rid of RSA entirely actually TLS 1.3 may even allow it to stick around a bit longer by reducing how nervous we are about it. If you care primarily about Forward Secrecy then sure, problem fixed.
        wolf550e 8y ago
        'tptacek meant "RSA ciphersuites", not "RSA trapdoor function". The cipher suites that begin with TLS_RSA_* and used RSA encryption to pass key material from client to server, encrypted with the server's long term key (the key from the certificate).

snvzz 8y ago

Let them spend money on new middleboxes, if they care so much.

snvzz 8y ago

>I'm sure they'll be happy to turn it off. They'd turn it off if the alternative was to be offline because the middlebox crashes a second after power on.