5 ms·

Endpoint supervising isn't always an option. As more IoT devices start to use TLS connections to phone home, a network MITM may be the only way to see what they

Endpoint supervising isn't always an option. As more IoT devices start to use TLS connections to phone home, a network MITM may be the only way to see what they're reporting. Breaking TLS isn't just something that Big Brother would want to do. (This is assuming they aren't using pinned certs baked into their firmware, anyhow. I don't have good data on which manufacturers/devices are doing this, but somebody else might know.)

JoshTriplett 7y ago
If you want to reverse-engineer those devices, do that in a reverse-engineering lab; you may need to dissect the device to figure out what it's doing. Alternatively, run more open devices. If you want to run those devices in production, put them in a separate network or VLAN where they can't see anything they don't need to see.
- ocdtrekkie 7y ago
  The problem is that as you advocate for encrypted communications with mysterious cloud endpoints, they just refuse to work unless they can talk to Google or other bad actors in secrer. Trust is unraveled by the unfortunate mistake of letting the PKI structure become the ultimate definition of trust in the world. As it is, don't Chromecasts refuse to function if they can't reach 8.8.8.8? Add encrypted DNS to prevent inspection and transparency, and people are being asked to have potentially hostile devices in their network with no way to inspect them.
  - JoshTriplett 7y ago
    If you want to treat a company as a "bad actor", don't have a device they built and supply all the software for on your network or give it access to anything you don't want it to have. (And the PKI infrastructure is the best thing we have; I'd certainly like to see it replaced with something even better.)
    - ocdtrekkie 7y ago
      "Just don't use untrustworthy hardware and software" isn't really viable when Windows, MacOS, iOS, and Android (incl. Play Services) are all proprietary closed source operating systems, covering over 90% of all consumer computing devices. Before you include all of the IoT space, which also tend to be proprietary. So creating a system where I, as a consumer, have no way to inspect the communication my devices undertake removes my rights and safety in deference to companies that really just want to make it harder to block ads. I take issue with this entire model. The fact that PKI has had piles of issues with bad actors who are supposedly supposed to be bastions of trust doesn't give any example this is a system we should trust, much less have browsers force people to utilize and scare people off avoiding.

JoshTriplett 7y ago

If you want to reverse-engineer those devices, do that in a reverse-engineering lab; you may need to dissect the device to figure out what it's doing. Alternatively, run more open devices. If you want to run those devices in production, put them in a separate network or VLAN where they can't see anything they don't need to see.

ocdtrekkie 7y ago
The problem is that as you advocate for encrypted communications with mysterious cloud endpoints, they just refuse to work unless they can talk to Google or other bad actors in secrer. Trust is unraveled by the unfortunate mistake of letting the PKI structure become the ultimate definition of trust in the world. As it is, don't Chromecasts refuse to function if they can't reach 8.8.8.8? Add encrypted DNS to prevent inspection and transparency, and people are being asked to have potentially hostile devices in their network with no way to inspect them.
- JoshTriplett 7y ago
  If you want to treat a company as a "bad actor", don't have a device they built and supply all the software for on your network or give it access to anything you don't want it to have. (And the PKI infrastructure is the best thing we have; I'd certainly like to see it replaced with something even better.)
  - ocdtrekkie 7y ago
    "Just don't use untrustworthy hardware and software" isn't really viable when Windows, MacOS, iOS, and Android (incl. Play Services) are all proprietary closed source operating systems, covering over 90% of all consumer computing devices. Before you include all of the IoT space, which also tend to be proprietary. So creating a system where I, as a consumer, have no way to inspect the communication my devices undertake removes my rights and safety in deference to companies that really just want to make it harder to block ads. I take issue with this entire model. The fact that PKI has had piles of issues with bad actors who are supposedly supposed to be bastions of trust doesn't give any example this is a system we should trust, much less have browsers force people to utilize and scare people off avoiding.