4 ms·
Good that they are taking action, however blacklisting that specific CA cert seems like a hacky band aid fix. This is going to end in a cat and mouse game and a
by jupp0r 7y ago
Good that they are taking action, however blacklisting that specific CA cert seems like a hacky band aid fix. This is going to end in a cat and mouse game and again shows how broken the whole CA system really is. What I whish they would do is block all “enterprise” CAs and restrict verification chains to end in a list of a few white listed CAs. I understand how disruptive this would be, but in the end it would result in better security for everyone. There are no legitimate reasons for breaking end to end encryption in my opinion.
- AndrewDucker 7y agoThat would result in that browser being banned by my company (amongst many others). We have a regulatory requirement to prevent any customer data (and a lot of other data) leaving the premises. Anything which prevents the proxies from scanning all requests to ensure they don't contain regulated data would get blocked very quickly.
- jupp0r 7y agoThat’s why I wrote “I understand how disruptive this would be, but in the end it would result in better security for everyone.” Your man in the middle scanner won’t prevent any data from leaving the premises, it’s pure snake oil.
- prepend 7y agoThere are ways to do this without intercepting HTTPS. Does your company monitor all phone calls looking for Morse code? Does your company monitor all photocopies? All photos taken with phones? There are reasonable precautions that can be taken and proxying all traffic is a bit of an overkill. Interestingly, I’m waiting for some IP lawsuit as MITM is technically breaking encryption and breaking encryption for DRM is against the DMCA. So MITM HTTPS traffic to Spotify should be in violation of us copyright law. But I’ve never heard of a case.
- pferde 7y agoMITM in this context is definitely not "breaking encryption". You have two legitimate, untampered-with TLS connections - one from the client to the proxy, one from the proxy to the destination web server. Nobody is breaking encryption used in these connections. What this might be considered breaking instead is trust.
- prepend 7y agoI think it’s legally grey. The expectation and design of the interaction is that the channel is secure between client and server. The equipment is owned by the company, not the individual. But the license is between the user and Spotify. The company is accessing the IP without a license and only accessed it by bypassing Spotify’s encryption. I think it’s similar if Safari was MITMing requests without consent from both parties. I’m interested in a legal ruling.
- stordoff 7y ago> I understand how disruptive this would be, but in the end it would result in better security for everyone. I disagree. I could quite easily see this resulting in companies using old browser versions, or hacking in a potentially exploitable way to get MITM access. An enterprise CA is at least a fairly well-known and understood risk. I also don't see why I shouldn't be able to have an internal CA for my internal services.
- jupp0r 7y ago> I also don't see why I shouldn't be able to have an internal CA for my internal services. Because this enables every player in the system to issue valid certificates for bankofamerica.com and rob their bank accounts? It's easy and cheap nowadays to get regular certificates for your internal services with letsencrypt.
- amaccuish 7y ago> Because this enables every player in the system to issue valid certificates for bankofamerica.com and rob their bank accounts? No it doesn't. The CA has to be installed for the certificate to be valid. It only enables one "player", the CA you choose, to do that. Internal CAs are still important. It's not always possible to have outbound access to Letsencrypt or register every single machine in external DNS.
- stordoff 7y agoIf something can install a root CA on my system, I feel like I've already lost.