4 ms·
MITM should be completely illegal. Why does this even need to be stated?
by kanox 6y ago
MITM should be completely illegal.
Why does this even need to be stated?
- ccmcarey 6y agoSeriously, you can think of no reasons? Many competent companies MITM employee traffic to scan for malware, leaking confidential data, etc.
- kazinator 6y agoGrandparent comment by beckler says they were trying to make some IoT product. That will be deployed in situations where that happens; if your customer has a MITM set up, you just nod your head and sell them something that works in that setup. You can't say, "MITM should be illegal, please buy my non-auto-updating solution anyway and stop it with your MITM." Good thing beckler found this while eating their own dogfood due to their own network being that way. Imagine that everything worked fine in their environment and then so customers came back with this issue. Then they would be beavering away hacking up their own core snap or whatever.
- cortesoft 6y agoShould you not be able to MITM your own machines?
- kanox 6y agoOnly in dev environments. Not on machines used by employees.
- diffeomorphism 6y agoNot if other people are using them. There are different value tradeoffs in different countries. The US says it is okay to spy on employees for no reason at all as long as you use company equipment. The EU says that employees like every other human being have rights and you better have a good reason and do so in a respectful way and be clear about it.
- MPSimmons 6y agoFor some situations, it's called for, but it's a huge pain in the ass. I am in a similar situation, and I need to patch every docker image I use. It's terrible to deal with, as an engineer, but the information security team does catch and eliminate a lot of content-based attacks.
- compuguy 6y agoI agree its a pain. It also makes things like working with other private certificate authorities (DoD Cert authority, other private certs) a pain. I spent a decent amount of time trying to get certain work/project related sites whitelisted from our MITM proxy because it didn't recognize the certificate chain...
- GekkePrutser 6y agoIn your own company you're free to do what you want. I can understand the reason for this. Now that most suppliers treat their devices as 'black boxes' and call home to install updates whenever they want, the security team no longer has visibility nor control over this. So much stuff runs Linux which we don't manage but still has to have full access to our network. And public repositories have been compromised and spread malware in the past. So yeah I totally understand this, even though as an enterprise Admin it's a total PITA to manage the root CAs.
- kanox 6y ago> In your own company you're free to do what you want. No, it's corporate MITM specifically which should be illegal.
- deleted 6y ago[deleted]