4 ms·
Regarding your second point, this change will improve privacy for your clients and make it harder for bad actors to take advantage of your network. So what's no
by shawnz 8y ago
Regarding your second point, this change will improve privacy for your clients and make it harder for bad actors to take advantage of your network. So what's not to like? Just because your old tooling won't work anymore doesn't mean that this change is a bad thing for clients.
- vetinari 8y agoIf it improves privacy for the clients, it also improves privacy for the malware, and you won't be able to monitor or be alerted of it.
- deleted 8y ago[deleted]
- stirfrykitty 8y agoMost modern firewalls can decrypt/re-encrypt all traffic on the fly. The end user doesn't even notice. I've done this at my last two jobs. More here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0 https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?...
- Murrawhip 8y agoWhat? The end user does notice if you haven't added the CA to the end user's PC.
- syshum 8y agoThat works by Man in the middle attacks of SSL and Only works on Enterprise Networks for devices owned by the enterprise because the Enterprise Installs their own Root Certs on all devices that "tricks" the browsers into believing they are "google.com" not the real google.com
- shawnz 8y agoRight, which is exactly how it should be. If you want to perform a purposeful man in the middle attack on your clients, then you SHOULD be required to install your root cert on their workstations. With unencrypted DNS, it just means that you can perform the same attack with NO specific approval by the client workstation. How is that better?
- snazz 8y agoYou get an HTTPS error if someone performs a DNS MITM and you’re not set up specifically to trust their certificate. It’s equivalent to performing an HTTPS MITM without the root cert installed.
- vetinari 8y agoYes, it works, by software or devices that cooperate. With desktop OSes, it is no problem. With mobiles, traditionally, if you enrolled a custom CA root onto Android device, the user would be nagged ("You network may be monitored"). Malware can go further, and just use it's own root, without any ability to enroll your custom one. I see this as a default with any IoT or embedded devices, so that will make much more difficult to say "no custom CA, no internet access".
- JohnFen 8y ago> make it harder for bad actors to take advantage of your network. How so? It looks to me like it makes it easier for bad actors to take advantage of my network, by making it harder to detect and block DNS lookups.
- glennpratt 8y agoYou are focused on unsophisticated bad actors if DNS is all it takes to block.
- JohnFen 8y agoI don't understand your point. I'm certainly not solely focused on the unsophisticated ones, but those sorts are important too. And they're much more common as they include ad and other trackers.
- glennpratt 8y agoYou want a warm blanket that you blocked some well known ad click tracker while having no real visibility overall. Security theater.
- JohnFen 8y agoYou would be correct if that were my attitude, but it's not. This is not a panacea, it's one component in a larger security posture.
- shawnz 8y agoIf DNS-based access control is not sufficient on it's own, then is it really worth it to block DoH (which could have other significant security and privacy benefits) just to retain the possibility of using it? Why not focus on improving those other, already necessary access control technologies and forget about abusing DNS for this purpose, so we get the best of both worlds?