5 ms·

Aren't businesses that are serious about meeting their legal/regulatory obligations for controlling internet access already using full MITM TLS interception wit

by growse 8y ago

Aren't businesses that are serious about meeting their legal/regulatory obligations for controlling internet access already using full MITM TLS interception with their own CAs? Given a malicious actor can register any old domain and get a cert for it very easily, I'm not sure what particular threat blocking TLS connections based just on the SNI is actually protecting you from.

tialaramex 8y ago
Backside covering at the cheapest possible price is the goal. It's not about whether it achieves the regulatory goal, just whether it gets a check on the list. The previous iteration of backside covering pondered the unencrypted server certificate, on the rationale that if this is a bad guy why do they have a good guy's certificate. If you know any cryptography, you are now thinking "But, wait, how does that secure anything?" but you aren't the target customer. The target customer verifies that this blocks them from accessing a "Bad" site in Internet Explorer and they're happy to part with $$ instead of the $$$ it would cost to do full blown HTTPS proxy for every connection. In TLS 1.3 this server certificate is encrypted. So the (perhaps slightly more untrustworthy) client SNI is pondered instead. What middlebox vendors would prefer not to mention is that in many cases they also figured TLS re-connections are always safe and can be allowed through. After all, if they didn't let bad guys make the original connection, how could those bad guys re-connect? TLS 1.3 exploited this to be "backward compatible" with such crapware, it says all its connections are "reconnections" so they pass through unmolested...
yardstick 8y ago
Think of all the small 1-2 employee businesses / mom & pop businesses etc that take credit cards. They have no dedicated IT person. They’d be lucky to have a dedicated LAN for payments (a PCI DSS requirement). Increasing the barriers to compliance for these people is not a good thing. In practice they will just close their eyes and pretend nothing is wrong, or they will just pay the fine charges by the banks for non compliance— which doesn’t improve your credit card security at all. You can’t tell all these small businesses they can’t take card payments, and you can’t make an already tough job harder, more complex and more expensive without an associated drop in compliance.
- growse 8y ago
  1-2 person businesses are likely outsourcing the entire problem of payment processing (and thus, the majority of the PCI controls) to a 3rd party like Stripe. The only PCI compliance needed then is an annual self-attestation which basically asks "Did you change your router's default password?" and "do you apply patches?" [1] There may be some mildly masochistic tiny businesses that choose to process / store payment details on their own networks and try to manage all the controls needed for that, but in the presence of so many options for outsourcing the problem, this doesn't seem like a particularly rational decision. > You can’t tell all these small businesses they can’t take card payments, and you can’t make an already tough job harder, more complex and more expensive without an associated drop in compliance. This is only true if there are no sane alternatives. [1] https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_1-SAQ-A.pdf https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_...
  - yardstick 8y ago
    For bricks and mortar businesses Stripe won’t help much, still need a chip and PIN reader on premise. Square on the other hand does let you outsource the entire problem of physical card payments to them, at the cost of much higher fees, as they are the merchant of record so you don’t need to be PCI compliant at all. Which is a real worry as that doesn’t give me much confidence when buying from a square “seller”. Their card reader originally didn’t encrypt data, and at least one model that did encrypt could be bypassed via tampering https://www.zdnet.com/article/square-reader-to-card-skimmer-in-less-than-10-minutes/ https://www.zdnet.com/article/square-reader-to-card-skimmer-... and while their current hardware may or may not have issues, they display a distinct lack of concern for local device security. Defense in depth is the way to go, but with Square you can put your Android/iOS device onto any WiFi network and without any security on who else is on it. Likewise you can download any random app that may look innocent enough but is full of exploits (eg an app that claims to help you manage a customer mailing list so you can grab signups on the same device as you take payments, or an app that claims to help with inventory levels, etc).
    - growse 8y ago

by growse 8y ago

tialaramex 8y ago

Backside covering at the cheapest possible price is the goal. It's not about whether it achieves the regulatory goal, just whether it gets a check on the list. The previous iteration of backside covering pondered the unencrypted server certificate, on the rationale that if this is a bad guy why do they have a good guy's certificate. If you know any cryptography, you are now thinking "But, wait, how does that secure anything?" but you aren't the target customer. The target customer verifies that this blocks them from accessing a "Bad" site in Internet Explorer and they're happy to part with $$ instead of the $$$ it would cost to do full blown HTTPS proxy for every connection. In TLS 1.3 this server certificate is encrypted. So the (perhaps slightly more untrustworthy) client SNI is pondered instead. What middlebox vendors would prefer not to mention is that in many cases they also figured TLS re-connections are always safe and can be allowed through. After all, if they didn't let bad guys make the original connection, how could those bad guys re-connect? TLS 1.3 exploited this to be "backward compatible" with such crapware, it says all its connections are "reconnections" so they pass through unmolested...

yardstick 8y ago

Think of all the small 1-2 employee businesses / mom & pop businesses etc that take credit cards. They have no dedicated IT person. They’d be lucky to have a dedicated LAN for payments (a PCI DSS requirement). Increasing the barriers to compliance for these people is not a good thing. In practice they will just close their eyes and pretend nothing is wrong, or they will just pay the fine charges by the banks for non compliance— which doesn’t improve your credit card security at all. You can’t tell all these small businesses they can’t take card payments, and you can’t make an already tough job harder, more complex and more expensive without an associated drop in compliance.

growse 8y ago
1-2 person businesses are likely outsourcing the entire problem of payment processing (and thus, the majority of the PCI controls) to a 3rd party like Stripe. The only PCI compliance needed then is an annual self-attestation which basically asks "Did you change your router's default password?" and "do you apply patches?" [1] There may be some mildly masochistic tiny businesses that choose to process / store payment details on their own networks and try to manage all the controls needed for that, but in the presence of so many options for outsourcing the problem, this doesn't seem like a particularly rational decision. > You can’t tell all these small businesses they can’t take card payments, and you can’t make an already tough job harder, more complex and more expensive without an associated drop in compliance. This is only true if there are no sane alternatives. [1] https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_1-SAQ-A.pdf https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_...
- yardstick 8y ago
  For bricks and mortar businesses Stripe won’t help much, still need a chip and PIN reader on premise. Square on the other hand does let you outsource the entire problem of physical card payments to them, at the cost of much higher fees, as they are the merchant of record so you don’t need to be PCI compliant at all. Which is a real worry as that doesn’t give me much confidence when buying from a square “seller”. Their card reader originally didn’t encrypt data, and at least one model that did encrypt could be bypassed via tampering https://www.zdnet.com/article/square-reader-to-card-skimmer-in-less-than-10-minutes/ https://www.zdnet.com/article/square-reader-to-card-skimmer-... and while their current hardware may or may not have issues, they display a distinct lack of concern for local device security. Defense in depth is the way to go, but with Square you can put your Android/iOS device onto any WiFi network and without any security on who else is on it. Likewise you can download any random app that may look innocent enough but is full of exploits (eg an app that claims to help you manage a customer mailing list so you can grab signups on the same device as you take payments, or an app that claims to help with inventory levels, etc).
  - growse 8y ago