3 ms·

What would be some examples of these middle boxes?

detaro 8y ago
Typically "smart" firewalls/internet filtering things.
jeroenhd 8y ago
Load balancers, IDS systems, traffic analysis, bad firewalls, content filtering systems, transparent proxies, some kinds of "intelligent switches", consumer routers with AV capabilities. Also anything sold by Blue Coat. You can read detailed examples on Cloudflare's blog, they've been very eager to experiment with TLS 1.3: https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet/ https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet...
LinuxBender 8y ago
IDP's / IPS's, firewalls that need to inspect payload, MitM Proxies such as Bluecoat, Websense, etc.., network appliances that create layer-7 flow data for debugging applications such as TrueSight and many more. Most big companies have contractual requirements to have an IPS/IDP to protect their customers. TLS1.3 means putting the decryption at the edge, which not everyone has done, then re-encrypting with something their IDP can decrypt.
- LeonM 8y ago
  I visited an infosec trade show recently, you wouldn't believe how many of these boxes are offered to 'improve' corporate security... Most of these boxes will break security chains, spoof DNS responses, require self-signed certs, etc. It's garbage. Kinda reminded me of 'the box' from the Silicon Valley TV-show. I guess corporate managers will prefer something tangible over actual good practices.
  - supertrope 8y ago
    Training is expensive and people will still click on ransomware payloads. Security appliances outsource blame.
  - jandrese 8y ago
    My favorite are the ones that re-sign connections without ever verifying that the original connection was signed by a legitimate authority.
    - Tharkun 8y ago
      I encountered an interesting one at $bigcorp which required everyone in the corp to install shady certificates, and which would then inject <script> tags in all HTTP responses, including in XML and JSON REST responses. That was fun to debug.
      - jandrese 8y ago
        It's pretty common for these devices to require you to install their generated CA cert on every machine in the corporation. Administrators deploy it to the domain with a group policy object IIRC. Firefox users end up having to install it by hand, or else every website comes up as "you are being attacked by a MITM!!!!", which is technically true.
        spockz 8y ago
        Sadly this also puts laptop users in the situation that they always need to vpn to the office otherwise sites that use HSTS will break either when on or outside the corporate networks, depending on when you visited the site first.
        londons_explore 8y ago
        HSTS allows self signed certs as long as the cert is manually installed to the OS trust store for exactly that reason.
        spockz 8y ago
        Okay. Does that also hold when only the CA is installed? On my machine both Safari and Chrome prevent loading google and stackoverflow because when accessing them through the corporate proxy I get a certificate which is signed by the corporate inspection gateway ca.

Typically "smart" firewalls/internet filtering things.

Load balancers, IDS systems, traffic analysis, bad firewalls, content filtering systems, transparent proxies, some kinds of "intelligent switches", consumer routers with AV capabilities. Also anything sold by Blue Coat. You can read detailed examples on Cloudflare's blog, they've been very eager to experiment with TLS 1.3: https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet/ https://blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet...

LinuxBender 8y ago

IDP's / IPS's, firewalls that need to inspect payload, MitM Proxies such as Bluecoat, Websense, etc.., network appliances that create layer-7 flow data for debugging applications such as TrueSight and many more. Most big companies have contractual requirements to have an IPS/IDP to protect their customers. TLS1.3 means putting the decryption at the edge, which not everyone has done, then re-encrypting with something their IDP can decrypt.

LeonM 8y ago
I visited an infosec trade show recently, you wouldn't believe how many of these boxes are offered to 'improve' corporate security... Most of these boxes will break security chains, spoof DNS responses, require self-signed certs, etc. It's garbage. Kinda reminded me of 'the box' from the Silicon Valley TV-show. I guess corporate managers will prefer something tangible over actual good practices.
- supertrope 8y ago
  Training is expensive and people will still click on ransomware payloads. Security appliances outsource blame.
- jandrese 8y ago
  My favorite are the ones that re-sign connections without ever verifying that the original connection was signed by a legitimate authority.
  - Tharkun 8y ago
    I encountered an interesting one at $bigcorp which required everyone in the corp to install shady certificates, and which would then inject <script> tags in all HTTP responses, including in XML and JSON REST responses. That was fun to debug.
    - jandrese 8y ago
      It's pretty common for these devices to require you to install their generated CA cert on every machine in the corporation. Administrators deploy it to the domain with a group policy object IIRC. Firefox users end up having to install it by hand, or else every website comes up as "you are being attacked by a MITM!!!!", which is technically true.
      - spockz 8y ago
        Sadly this also puts laptop users in the situation that they always need to vpn to the office otherwise sites that use HSTS will break either when on or outside the corporate networks, depending on when you visited the site first.
        londons_explore 8y ago
        HSTS allows self signed certs as long as the cert is manually installed to the OS trust store for exactly that reason.
        spockz 8y ago
        Okay. Does that also hold when only the CA is installed? On my machine both Safari and Chrome prevent loading google and stackoverflow because when accessing them through the corporate proxy I get a certificate which is signed by the corporate inspection gateway ca.