5 ms·

Please don't do this anymore. End-to-end encryption is extremely easy to set up and maintain. P2PE will absolutely lull you into a false sense of security.

sofaofthedamned 7y ago
Eh, don't teach my about the systems I run. I'd love to run TLS end to end but in this one? Nah, not worth it.
- baq 7y ago
  I work at $CORP. I don't trust my enterprise IT department with unencrypted traffic for fear of falling victim to stupid traffic shaping or deep packet inspection intrusion prevention going haywire.
  - sofaofthedamned 7y ago
    Good for you. In my current gig the trade-off is different. I don't work for Google.
- arcticbull 7y ago
  "Don't teach me about ..." -- aren't we all here to learn? Let's keep the tone civil and assume the best.
solatic 7y ago
Last time I checked, mTLS incurred significant performance penalties and required significant soak testing to ensure that performance would be acceptable for a given application. If you're a small company, you have much lower hanging fruit to chase.
- jacques_chester 7y ago
  In my understanding there's additional overhead at handshake, but after that the performance is basically identical. The client certificate mostly acts to identify the client to the server, but otherwise the business of picking session keys etc is the same. At this point TLS overhead is close to free. I think the start of this thread was a plea not to terminate HTTPS at the edge, but instead to plumb it all the way to the serving container. That's unlikely to be mTLS in any case.
res0nat0r 7y ago
Everyone seems to think E2E encryption is needed everywhere (I know because the security guys at work think it is needed everywhere, even for everything inside a VPC), but even AWS here is advertising the fact that you don't need to do this: https://aws.amazon.com/blogs/aws/new-tls-termination-for-network-load-balancers/ https://aws.amazon.com/blogs/aws/new-tls-termination-for-net... >Today we are simplifying the process of building secure web applications by giving you the ability to make use of TLS (Transport Layer Security) connections that terminate at a Network Load Balancer (you can think of TLS as providing the “S” in HTTPS). This will free your backend servers from the compute-intensive work of encrypting and decrypting all of your traffic, while also giving you a host of other features and benefits:
- disiplus 7y ago
  but without tls amazon can "decrypt" your traffic and see whats inside. its one thing to have a backdoor inside a server that they rent to you that would have to be actively exploited and another to passively clone the traffic and analyze it in the name of making the service better.
  - smolder 7y ago
    Why do they have to actively exploit hardware/vms that they own? Isn't it pretty trivial for a hypervisor to "passively clone" data right out of the memory of the VM? Or to use management interfaces/custom peripherals to exfiltrate data if it were bare metal? AWS is kind of a black box to me but it seems hopeless to try to protect data from people that physically control the systems.
    - disiplus 7y ago
      i was especially talking about passively mirroring/analysing network traffic. afak there is no easy and trivial way to "passively clone" aka dump memory of the hypervisor all the time without it being detectable in slowdowns and so on. my concern was not that i need to protect myself from amazon for the fear that they will hack my server, but to the way that they can get insight into my customers, maybe get a snippet of the data i get and so on. we once saw this from some other company where they noticed we where talking to the competitors and wanted to talk.
StreamBright 7y ago
It does not matter how easy it is, what is the security threat you are mitigating with E2E encryption? In a large scale system it is often not trivial to build a proper E2E, far from being impossible though.
crehn 7y ago
What's an extremely easy solution to set up and maintain automated certificate signing and provisioning?
- dserodio 7y ago
  CloudFlare's cfssl: http://blog.cloudflare.com/introducing-cfssl http://blog.cloudflare.com/introducing-cfssl

sofaofthedamned 7y ago

Eh, don't teach my about the systems I run. I'd love to run TLS end to end but in this one? Nah, not worth it.

baq 7y ago
I work at $CORP. I don't trust my enterprise IT department with unencrypted traffic for fear of falling victim to stupid traffic shaping or deep packet inspection intrusion prevention going haywire.
- sofaofthedamned 7y ago
  Good for you. In my current gig the trade-off is different. I don't work for Google.
arcticbull 7y ago
"Don't teach me about ..." -- aren't we all here to learn? Let's keep the tone civil and assume the best.

solatic 7y ago

Last time I checked, mTLS incurred significant performance penalties and required significant soak testing to ensure that performance would be acceptable for a given application. If you're a small company, you have much lower hanging fruit to chase.

jacques_chester 7y ago
In my understanding there's additional overhead at handshake, but after that the performance is basically identical. The client certificate mostly acts to identify the client to the server, but otherwise the business of picking session keys etc is the same. At this point TLS overhead is close to free. I think the start of this thread was a plea not to terminate HTTPS at the edge, but instead to plumb it all the way to the serving container. That's unlikely to be mTLS in any case.

res0nat0r 7y ago

Everyone seems to think E2E encryption is needed everywhere (I know because the security guys at work think it is needed everywhere, even for everything inside a VPC), but even AWS here is advertising the fact that you don't need to do this: https://aws.amazon.com/blogs/aws/new-tls-termination-for-network-load-balancers/ https://aws.amazon.com/blogs/aws/new-tls-termination-for-net... >Today we are simplifying the process of building secure web applications by giving you the ability to make use of TLS (Transport Layer Security) connections that terminate at a Network Load Balancer (you can think of TLS as providing the “S” in HTTPS). This will free your backend servers from the compute-intensive work of encrypting and decrypting all of your traffic, while also giving you a host of other features and benefits:

disiplus 7y ago
but without tls amazon can "decrypt" your traffic and see whats inside. its one thing to have a backdoor inside a server that they rent to you that would have to be actively exploited and another to passively clone the traffic and analyze it in the name of making the service better.
- smolder 7y ago
  Why do they have to actively exploit hardware/vms that they own? Isn't it pretty trivial for a hypervisor to "passively clone" data right out of the memory of the VM? Or to use management interfaces/custom peripherals to exfiltrate data if it were bare metal? AWS is kind of a black box to me but it seems hopeless to try to protect data from people that physically control the systems.
  - disiplus 7y ago
    i was especially talking about passively mirroring/analysing network traffic. afak there is no easy and trivial way to "passively clone" aka dump memory of the hypervisor all the time without it being detectable in slowdowns and so on. my concern was not that i need to protect myself from amazon for the fear that they will hack my server, but to the way that they can get insight into my customers, maybe get a snippet of the data i get and so on. we once saw this from some other company where they noticed we where talking to the competitors and wanted to talk.

StreamBright 7y ago

It does not matter how easy it is, what is the security threat you are mitigating with E2E encryption? In a large scale system it is often not trivial to build a proper E2E, far from being impossible though.

crehn 7y ago

What's an extremely easy solution to set up and maintain automated certificate signing and provisioning?

dserodio 7y ago
CloudFlare's cfssl: http://blog.cloudflare.com/introducing-cfssl http://blog.cloudflare.com/introducing-cfssl