4 ms·
In a lot of corp env, a corp CA is injected, which allows middleware to MITM sessions. TLS 1.3 still allows this nonsense. Most current gen firewalls rely on
by mey 7y ago
In a lot of corp env, a corp CA is injected, which allows middleware to MITM sessions. TLS 1.3 still allows this nonsense. Most current gen firewalls rely on this to be useful.
- tialaramex 7y agoIn TLS 1.3 you can only do this by proxying all connections. Whereupon all these hypothetical non-compliant QUIC streams are yours and nobody on the rest of the Internet cares. This is a significant (and for the "IT security" industry expensive) change compared to previous versions but it was done with this in mind. The methods often employed to avoid doing proxying don't actually deliver security though they did ossify the protocol but they are cheaper. Too bad. Let's take my compression example again. Your "firewall" won't tell you it understands compressed certs since it has no idea what they are, and it won't request them from the server, no ossification. New features don't work for you inside your "firewall" making the Internet worse for you, but for everybody else improvements continue. The same for the spin bit. Corp A enforces a completely broken spin bit for "security", it suffers mysterious and hard to diagnose network faults but the rest of the Internet isn't affected and life continues as normal.