4 ms·

That would still require a custom cert installed on the end user device, which may not be feasible in the case of some iot devices and generally a pain for most

That would still require a custom cert installed on the end user device, which may not be feasible in the case of some iot devices and generally a pain for most users in general, especially as more websites pin their certificates.

WorldMaker 8y ago
Pain for the users has never stopped enterprises from doing it, sadly.
- jimktrains2 8y ago
  That is often handled by group policy. I'm not entirely aure how pinni is handled, maybe it's disabled in ie or chrome via group policy too?
  - WorldMaker 8y ago
    Just because it is handled automatically by "group policy" doesn't mean that users don't feel day-to-day pains from it. It just means it is more likely that don't understand where their pain is coming from. ("If I pull up google.com in Chrome or IE it works, but why can't I use Firefox?" "Because we don't support it here." [Because group policy deploying CA certificates to it is harder and it has stricter CA requirements, such as no self-signed certs.]) Enterprise IT can sweep some of that under the rug by controlling which software is allowable to be installed at all, but there's always going to be edge cases in a TLS Interception environment to cause users papercuts, at the very least. To answer your direct question: So far pinning in browsers is still just TOFU [Trust on First Use], I think? So pinning alone still works with TLS Interception so long as it is intercepted on Day One. The Chrome security team has been threatening for a couple versions now that certain pinned lists, including (but not limited to) Google's own sites, would be baked into the browser in such a way that no one should be able to disable them. I wish they have the gumption to pull that off. With Chrome being the current darling browser of a lot of the same IT groups using TLS Interception, that might actually send a clear message that TLS Interception is a bad idea. Unfortunately, it might just be received as "Here's Google's list of sites that have to be whitelisted or outright blocked from our Interception Proxies so as not to confuse our users", but that would still be a step in the right direction in so far as end-to-end internet security.

WorldMaker 8y ago

Pain for the users has never stopped enterprises from doing it, sadly.

jimktrains2 8y ago
That is often handled by group policy. I'm not entirely aure how pinni is handled, maybe it's disabled in ie or chrome via group policy too?
- WorldMaker 8y ago
  Just because it is handled automatically by "group policy" doesn't mean that users don't feel day-to-day pains from it. It just means it is more likely that don't understand where their pain is coming from. ("If I pull up google.com in Chrome or IE it works, but why can't I use Firefox?" "Because we don't support it here." [Because group policy deploying CA certificates to it is harder and it has stricter CA requirements, such as no self-signed certs.]) Enterprise IT can sweep some of that under the rug by controlling which software is allowable to be installed at all, but there's always going to be edge cases in a TLS Interception environment to cause users papercuts, at the very least. To answer your direct question: So far pinning in browsers is still just TOFU [Trust on First Use], I think? So pinning alone still works with TLS Interception so long as it is intercepted on Day One. The Chrome security team has been threatening for a couple versions now that certain pinned lists, including (but not limited to) Google's own sites, would be baked into the browser in such a way that no one should be able to disable them. I wish they have the gumption to pull that off. With Chrome being the current darling browser of a lot of the same IT groups using TLS Interception, that might actually send a clear message that TLS Interception is a bad idea. Unfortunately, it might just be received as "Here's Google's list of sites that have to be whitelisted or outright blocked from our Interception Proxies so as not to confuse our users", but that would still be a step in the right direction in so far as end-to-end internet security.