5 ms·

The NSA Warns of TLS Inspection

12 points by hsnewman 7y ago

Jonnax 7y ago
I've always wondered why browser's don't let you know that you're using a certificate of dubious origin. Certainly it would make employees more aware to not log into their personal stuff at work.
- luxuryballs 7y ago
  I thought they did?
  - Jonnax 7y ago
    For corporate Man in the middle security products, it's a managed device where they put a root certificate on the device.
    - basch 7y ago
      Or an edge device capable of basically impersonating ca's. https://news.ycombinator.com/item?id=11781915 https://news.ycombinator.com/item?id=11781915
- musicale 7y ago
  Doesn't Chrome refuse to trust "Google" certificates issued by random third parties? Presumably it should complain when some site claiming to be gmail presents some bogus corporate MITM certificate rather than a certificate issued by Google itself? If so, maybe that's a good reason to use Chrome for gmail. ;-)
  - dastx 7y ago
    Not sure where you got this from, by company I work for had multiple CA roots, and they intercept all traffic. Chrome has never complained about Google and I've confirmed it's certificate is actually issued by my company's CA.
    - dogma1138 7y ago
      Chrome supports “managed mode” to override HPKP if it’s not done it will definitely complain when accessing google services with a different certificate. That said afaik it’s only limited to some google services primarily those which are used for login and account management.
- dastx 7y ago
  Not sure how one would achieve this. It certainly would require new infrastructure. As far as the browser is concerned, the certificate is issued by a root CA that the computer (or browser) trusts. You'd need a tool or a header or something that tells the browser what the original cert is. The browser could then check if this matches the actual cert and then warn.
  - zamadatix 7y ago
    It's not like there is an overflowing number of publicly trusted CAs. Just encode the list in the signed browser code. Of it's not in the list but it's in the machines trusted root store still trust it but note it's an uncommon CA to the user.
  - dogma1138 7y ago
    It doesn’t require new infrastructure most modern browsers support HTTP Public Key Pinning. Since the browser vendor can pin their own keys in the distribution it gives you a sufficiently resilient proof against impersonation as all other keys can be validated through a connection that is known to be non susceptible to impersonation.
OmarYaacoubi 7y ago
There are new methods for TLS inspection, it can be done without decryption using a combination of machine learning and metadata to spot known attacks/malware/C&C and abnormality with high accuracy. We do that at barac (www.barac.io). Would love to demo and discuss our unique approach

12 points by hsnewman 7y ago

I've always wondered why browser's don't let you know that you're using a certificate of dubious origin. Certainly it would make employees more aware to not log into their personal stuff at work.

luxuryballs 7y ago
I thought they did?
- Jonnax 7y ago
  For corporate Man in the middle security products, it's a managed device where they put a root certificate on the device.
  - basch 7y ago
    Or an edge device capable of basically impersonating ca's. https://news.ycombinator.com/item?id=11781915 https://news.ycombinator.com/item?id=11781915
musicale 7y ago
Doesn't Chrome refuse to trust "Google" certificates issued by random third parties? Presumably it should complain when some site claiming to be gmail presents some bogus corporate MITM certificate rather than a certificate issued by Google itself? If so, maybe that's a good reason to use Chrome for gmail. ;-)
- dastx 7y ago
  Not sure where you got this from, by company I work for had multiple CA roots, and they intercept all traffic. Chrome has never complained about Google and I've confirmed it's certificate is actually issued by my company's CA.
  - dogma1138 7y ago
    Chrome supports “managed mode” to override HPKP if it’s not done it will definitely complain when accessing google services with a different certificate. That said afaik it’s only limited to some google services primarily those which are used for login and account management.
dastx 7y ago
Not sure how one would achieve this. It certainly would require new infrastructure. As far as the browser is concerned, the certificate is issued by a root CA that the computer (or browser) trusts. You'd need a tool or a header or something that tells the browser what the original cert is. The browser could then check if this matches the actual cert and then warn.
- zamadatix 7y ago
  It's not like there is an overflowing number of publicly trusted CAs. Just encode the list in the signed browser code. Of it's not in the list but it's in the machines trusted root store still trust it but note it's an uncommon CA to the user.
- dogma1138 7y ago
  It doesn’t require new infrastructure most modern browsers support HTTP Public Key Pinning. Since the browser vendor can pin their own keys in the distribution it gives you a sufficiently resilient proof against impersonation as all other keys can be validated through a connection that is known to be non susceptible to impersonation.

OmarYaacoubi 7y ago

There are new methods for TLS inspection, it can be done without decryption using a combination of machine learning and metadata to spot known attacks/malware/C&C and abnormality with high accuracy. We do that at barac (www.barac.io). Would love to demo and discuss our unique approach