3 ms·
> and nobody is MITMing https Any security professional asserting this doesn't know whereof they speak. There are entire product categories of MITM devices ("T
by _jal 7y ago
> and nobody is MITMing https
Any security professional asserting this doesn't know whereof they speak. There are entire product categories of MITM devices ("TLS inspection") for sale. Another poster mentions nation states doing this openly.
Buy aside from many corporations and some nations states, nobody is doing this, full stop.
- bsamuels 7y agoWhen it comes to cybercrime, it's a prospect of "how much time & money will it take to make X dollars" Maybe at one point in the future, purchase of theoretical MITM devices and deploying them in a dragnet of free wifi access points without the FBI finding out will be profitable. But for now, there's much cheaper and more profitable ways to make money criminally.
- nodesecurity 7y agoThe OP was correct. Yes TLS inspection exists, but requires a special CA certificate installed on the device. Yes, state actors have compromised CA's. Yes yes yes it's all possible and does happen. No, you're not being MITM'ed when you connect to a restaurant wifi. If everything needs to be qualified to the millionth degree, with every caveat laid out and explained, we won't have time to discuss interesting things. The OPs comment is correct general advice.
- _jal 7y agoI'm well aware of how inspection works. You are more than welcome to make your own risk evaluations, but you're looking at this through too narrow a lens. The OP may be sort-of correct for your average first-world facebook-phone user with "nothing to hide", so I kind of agree with your last sentence. But it is way too blithe and unconcerned, and, well, they won't be the first self-described "security expert" who's judgement I find lacking.
- tsimionescu 7y agoCorporate TLS Inspection products rely on each user (or the system administrators) installing the MITM certificate on all corporate systems. Unless users are also installing 'public' root certificates, this is a non-issue. And if users are installing bad root certificates, then a fully closed wifi network will not be very good protection either way. Now, nation states, which may be able to obtain valid PKI certificates for MITM purposes, are a whole other level of adversary. Still, again, anyone who can do that will probably not be deterred by you using a WPA-PSK2 protected Wi-Fi AP. So, overall, I don't see what kind of increased security risk you would be exposing yourself to by using public wifi networks.
- _jal 7y agoOP said "full stop". You don't make a categorical claim like that with a large asterisk when talking about things like this. "Nobody can open this lock, full stop." "...well, except for nation states, and people who can touch it."
- vetinari 7y agoThe point is, that the user has to do explicit action to allow TLS MITM. You cannot MITM until the user allows that, or uses a device that was already configured to allow that.
- deleted 7y ago[deleted]
- vetinari 7y agoIn corporations, you need to enroll custom CA cert for that - usually done when enrolling devices into MDM, or when joining domain - you cannot MITM random devices. For nation states, they started to require the custom CA cert as well via legislation, see the recent Kazakhstan story.