3 ms·

Yeah it is a super dumb excuse. The real reason is this: > Our IT team is going to have to do some work and expose that traffic is sent unencrypted (or differe

Yeah it is a super dumb excuse. The real reason is this: > Our IT team is going to have to do some work and expose that traffic is sent unencrypted (or differently encrypted) to the final hop on the network. I get why IT teams don't want to, especially for huge organizations, but "lol we can MITM TLS" is not acceptable. Terminate the exterior TLS at the network, inspect / log it, then re-black it to the end device. Also, I want to take a second to complain about locally installed certs. I know we all know how they work and everything, but most users don't. The fact that I can see a green lock for google.com when Eve has put a local cert on my machine is really stupid. People check their personal email on their work computers, that's just a fact of life. Their personal email password shouldn't be in some network log somewhere without them understanding that this is possible. There should be a different colour for when trust is different. A blue lock, for example. I know IT has root anyway, but most companies don't install key loggers on their gear or do obviously shady shit, and I think it would benefit users to have a clear demarcation about who they are trusting.

stefan_ 8y ago
Well, they should install keyloggers. Okay, not keyloggers per se, since they are pretty useless, but if you control the software on the device, you can monitor internet activity in a million and one ways, none of which involve breaking the internet. Looking at the Lewandowski stuff, that's what Google does. And for obvious reasons. Just logging internet traffic isn't very useful at all for compliance.
- 3pt14159 8y ago
  It isn't clear to me that that is what Google does, and installing a keylogger without informing employees is shady, no matter how you dice it. The network makes sense, but people "think outloud" while they revise draft emails. They change their mind on resigning or sending a harsh email. Big difference.
stanleydrew 8y ago
I like this idea of different signals for different levels of trust. In practice how would it be best implemented though? Some sort of entry in DNS that says "we have all certs signed by one of these two CAs" and then clients could see if a cert is valid but chains up to a different root and show "this is secure, but not in the way you think"?
- 3pt14159 8y ago
  Basically, yeah. And maybe it should be country-smart too. An HTTPS cert originating from China and being used for a Chinese service is green, but as the internet balkanizes we may want to be a little smarter. Not sure on that though.
unethical_ban 8y ago
>People check their personal email on their work computers, that's just a fact of life. Well, that's their dumbass fault. At our company, there is a giant warning on the login screen that "You are using a corporate asset and there is NO expectation of privacy." Now, as to the safety of browser locks... sounds great until the company patches their Firefox distribution.

stefan_ 8y ago

Well, they should install keyloggers. Okay, not keyloggers per se, since they are pretty useless, but if you control the software on the device, you can monitor internet activity in a million and one ways, none of which involve breaking the internet. Looking at the Lewandowski stuff, that's what Google does. And for obvious reasons. Just logging internet traffic isn't very useful at all for compliance.

3pt14159 8y ago
It isn't clear to me that that is what Google does, and installing a keylogger without informing employees is shady, no matter how you dice it. The network makes sense, but people "think outloud" while they revise draft emails. They change their mind on resigning or sending a harsh email. Big difference.

stanleydrew 8y ago

I like this idea of different signals for different levels of trust. In practice how would it be best implemented though? Some sort of entry in DNS that says "we have all certs signed by one of these two CAs" and then clients could see if a cert is valid but chains up to a different root and show "this is secure, but not in the way you think"?

3pt14159 8y ago
Basically, yeah. And maybe it should be country-smart too. An HTTPS cert originating from China and being used for a Chinese service is green, but as the internet balkanizes we may want to be a little smarter. Not sure on that though.

unethical_ban 8y ago

>People check their personal email on their work computers, that's just a fact of life. Well, that's their dumbass fault. At our company, there is a giant warning on the login screen that "You are using a corporate asset and there is NO expectation of privacy." Now, as to the safety of browser locks... sounds great until the company patches their Firefox distribution.