3 ms·

That would result in that browser being banned by my company (amongst many others). We have a regulatory requirement to prevent any customer data (and a lot of

That would result in that browser being banned by my company (amongst many others). We have a regulatory requirement to prevent any customer data (and a lot of other data) leaving the premises. Anything which prevents the proxies from scanning all requests to ensure they don't contain regulated data would get blocked very quickly.

jupp0r 7y ago
That’s why I wrote “I understand how disruptive this would be, but in the end it would result in better security for everyone.” Your man in the middle scanner won’t prevent any data from leaving the premises, it’s pure snake oil.
prepend 7y ago
There are ways to do this without intercepting HTTPS. Does your company monitor all phone calls looking for Morse code? Does your company monitor all photocopies? All photos taken with phones? There are reasonable precautions that can be taken and proxying all traffic is a bit of an overkill. Interestingly, I’m waiting for some IP lawsuit as MITM is technically breaking encryption and breaking encryption for DRM is against the DMCA. So MITM HTTPS traffic to Spotify should be in violation of us copyright law. But I’ve never heard of a case.
- pferde 7y ago
  MITM in this context is definitely not "breaking encryption". You have two legitimate, untampered-with TLS connections - one from the client to the proxy, one from the proxy to the destination web server. Nobody is breaking encryption used in these connections. What this might be considered breaking instead is trust.
  - prepend 7y ago
    I think it’s legally grey. The expectation and design of the interaction is that the channel is secure between client and server. The equipment is owned by the company, not the individual. But the license is between the user and Spotify. The company is accessing the IP without a license and only accessed it by bypassing Spotify’s encryption. I think it’s similar if Safari was MITMing requests without consent from both parties. I’m interested in a legal ruling.

jupp0r 7y ago

That’s why I wrote “I understand how disruptive this would be, but in the end it would result in better security for everyone.” Your man in the middle scanner won’t prevent any data from leaving the premises, it’s pure snake oil.

prepend 7y ago

There are ways to do this without intercepting HTTPS. Does your company monitor all phone calls looking for Morse code? Does your company monitor all photocopies? All photos taken with phones? There are reasonable precautions that can be taken and proxying all traffic is a bit of an overkill. Interestingly, I’m waiting for some IP lawsuit as MITM is technically breaking encryption and breaking encryption for DRM is against the DMCA. So MITM HTTPS traffic to Spotify should be in violation of us copyright law. But I’ve never heard of a case.

pferde 7y ago
MITM in this context is definitely not "breaking encryption". You have two legitimate, untampered-with TLS connections - one from the client to the proxy, one from the proxy to the destination web server. Nobody is breaking encryption used in these connections. What this might be considered breaking instead is trust.
- prepend 7y ago
  I think it’s legally grey. The expectation and design of the interaction is that the channel is secure between client and server. The equipment is owned by the company, not the individual. But the license is between the user and Spotify. The company is accessing the IP without a license and only accessed it by bypassing Spotify’s encryption. I think it’s similar if Safari was MITMing requests without consent from both parties. I’m interested in a legal ruling.