3 ms·

Breaking the security of HTTPS for surveillance and monitoring purposes. The BITS group is formally opposed to secure communications because they want to make

Breaking the security of HTTPS for surveillance and monitoring purposes. The BITS group is formally opposed to secure communications because they want to make it easier to MITM attack the secure communication. They want to make it easier to decrypt communication.

cbsmith 8y ago
...and they want that for transparency, not for nefarious reasons.
- JoshTriplett 8y ago
  MITMing TLS outside the endpoints is inherently nefarious, whether they think it is or not. If you want to compromise the endpoint, compromise the endpoint. Install your own MITM certificates and terminate the connection in the middle, or install client-side malware. Either way, there should always be a giant warning sign on the client that end-to-end security is compromised.
  - cbsmith 8y ago
    They don't want to compromise the endpoint. They want to ensure they have a record of all communications to and from the endpoint.
    - funkymike 8y ago
      In order to implement ETS they already have to compromise the endpoint to make the TLS 1.3 implementation use static keys, right?
      - cbsmith 8y ago
        Yeah, but it's a means to an end, not the end. The assumptions that TLS 1.3 is based around are in direct conflict with the requirements of the secure environment they operate in. This isn't some evil thing... a cryptographic protocol is a part of a trusted system, and whether it is appropriate for a particular context has to do with the design of the trusted system.
  - cbsmith 8y ago
    ...and in this context they aren't compromising it. They're just sharing their keys so that another component, all part of the same trusted system, can also decrypt the traffic.
    - cesarb 8y ago
      Sharing the key allows more than just decryption; it also allows undetectable modification of the traffic. A protocol which allowed third-party decryption but not modification would have been designed differently.
      - cbsmith 8y ago
        In this case the key is used by a system that is reading a log of the archived traffic. It has no direct network connectivity to the production traffic. I think we can safely say it isn't modifying the traffic... in fact, that's a requirement for the security apparatus.

cbsmith 8y ago

...and they want that for transparency, not for nefarious reasons.

JoshTriplett 8y ago
MITMing TLS outside the endpoints is inherently nefarious, whether they think it is or not. If you want to compromise the endpoint, compromise the endpoint. Install your own MITM certificates and terminate the connection in the middle, or install client-side malware. Either way, there should always be a giant warning sign on the client that end-to-end security is compromised.
- cbsmith 8y ago
  They don't want to compromise the endpoint. They want to ensure they have a record of all communications to and from the endpoint.
  - funkymike 8y ago
    In order to implement ETS they already have to compromise the endpoint to make the TLS 1.3 implementation use static keys, right?
    - cbsmith 8y ago
      Yeah, but it's a means to an end, not the end. The assumptions that TLS 1.3 is based around are in direct conflict with the requirements of the secure environment they operate in. This isn't some evil thing... a cryptographic protocol is a part of a trusted system, and whether it is appropriate for a particular context has to do with the design of the trusted system.
- cbsmith 8y ago
  ...and in this context they aren't compromising it. They're just sharing their keys so that another component, all part of the same trusted system, can also decrypt the traffic.
  - cesarb 8y ago
    Sharing the key allows more than just decryption; it also allows undetectable modification of the traffic. A protocol which allowed third-party decryption but not modification would have been designed differently.
    - cbsmith 8y ago
      In this case the key is used by a system that is reading a log of the archived traffic. It has no direct network connectivity to the production traffic. I think we can safely say it isn't modifying the traffic... in fact, that's a requirement for the security apparatus.