4 ms·

> Companies have a legal and moral imperative to see what content is leaving their network, and until some combination of host/network governance is developed t

> Companies have a legal and moral imperative to see what content is leaving their network, and until some combination of host/network governance is developed to only allow pre-authorized traffic to egress, MITM boxes will need to be supported. "a legal and moral imperative"? No. Such networks are security threats and should be repeatedly broken until they give up. It will become increasingly expensive to even try. And an increasing number of security researchers will find ways to make maintaining MITM technologies more difficult and less transparent. You can block spam and outbound attacks without MITMing traffic. MITMing traffic is not about protecting the outside world in any way. It's technology sold to companies out of fear (or misguided regulatory requirements). One day it will go the way of the virus scanner: dead, worse than useless, and only existing to satisfy a decreasing number of corporate checkboxes.

unethical_ban 6y ago
You completely ignore the concept of data breaches and preventing them. You complain about the alleged problem, "man in the middle" technologies, without any proposed solution. Let me be clear: If you do not think private companies and businesses have a right, and sometimes an obligation, to secure and monitor the traffic on their networks, then you are flat out incorrect, and this conversation can end. If you agree they need to monitor data, but that MITM technologies are a societal risk more than a benefit, I am all ears. Host-based data scanning at an OS level; signed traffic that the network can trust has been scanned by authorized hosts (so rogue hosts don't send traffic out); and so on. edit: I don't think your message is consistent, but I think that is not a sign of malice. You say "Companies have no legal or moral need to see what content is leaving their network" then say "You can block spam and outbound attacks without MITMing traffic." You seem to be equating "See the content leaving their network" with "MITM", but then say later that companies can "prevent outbound attacks" without MITM. The #1 threat for many companies is data loss. How do you propose DLP gets accomplished with zero access to the network?
- kstrauser 6y ago
  Your employer provides you with a medical insurance plan. On your break at work, you use your company laptop to access the insurer's website and use their find-a-doctor tool to search for a cancer doctor. This is a legitimate use of your work computer, after all. Does your employer have a right and obligation to see that you're searching for a cancer doctor? Go to a large company's IT department and find the person there you dislike the most. Do you want that person monitoring the traffic and seeing that you searched for a cancer doctor? Now you know why so very many of us believe you are completely wrong about this.
  - unethical_ban 6y ago
    Do you want your bank to be hacked and have a 50GB database backup with all your accounts and transaction history slow-leaked out via DNS queries? Now you see why so many of us believe you are completely wrong about this. To your point: If it is their network, it's their network and their computer. Access the website from home, or from your phone, which isn't MITM'ed on the corporate network. If it is a resource only available on the corporate network, but it is not a "company resource" such as find-a-doctor, then you can (a) accept that the company may see it, (b) contact information security and ask if they can, or (c) find another way to get the information/complain to HR/ombudsman/whatever. It is up to the company to do the right thing when possible, which means (in our case) we don't intercept websites categorized banking, health, and a handful of others. Information security obfuscates/blocks the showing of personally identifiable logs to the rest of IT, as well. Again, banks (in my example) have an obligation to their millions of customers to protect their data, more than you have a right to browse a doctor tool or upload sensitive spreadsheets to your personal Google Drive to work on over the weekend.
  - droitbutch 6y ago
    > Does your employer have a right and obligation to see that you're searching for a cancer doctor? Do you have the right to prioritize your personal activities over your employers protection of its' data? Creating blindspots on enterprise networks won't get far - especially not given today's realities of breaches.
    - 6y ago
- JoshTriplett 6y ago
  > You complain about the alleged problem, "man in the middle" technologies, without any proposed solution. I don't have to provide a "proposed solution" to MITM; the proposed solution is "stop that". To the extent MITM is getting harder, that means network protocols and software is getting better. This is like asking the makers of adblockers what their "proposed solution" is for ads, or asking the makers of spam filters what their "proposed solution" is for sending spam. Most critically, in a standards body, the right answer to people trying to MITM is a polite and diplomatic version of "go away, your use case is invalid". > If you do not think private companies and businesses have a right, and sometimes an obligation, to secure and monitor the traffic on their networks They can certainly try (currently), and one of the jobs of security researchers is to ensure they fail enough that they stop trying. I also hope one day that there's enough collective bargaining power among engineers that such companies cannot successfully hire people, and that nobody ever has to be desperate enough to accept such a draconian network. I'm glad I'm in a position to be able to say I'll never work for a company that requires MITM; everyone should be able to avoid that. And the only time I'm aware of a company having an obligation is due to misguided regulations on certain narrow classes of businesses. > MITM technologies are a societal risk more than a benefit The company is the only one who could possibly benefit, and that's leaving aside the likely possibility of doing more harm than good; security measures work better when your users want to help you rather than thwart you. Meanwhile, the societal harm of ever allowing MITM is massive. Right now, the biggest step I'd love to see happen is browsers (in concert) having a persistent banner for "your traffic is being MITMed" any time they're getting the wrong certificate for sites, and browsers making that impossible to remove without rebuilding the browser from source (which is a substantial barrier). Next, we can make it easy for sites to detect access from MITMed networks, and make policy decisions on that basis. Then, coalitions of sites can collectively make it expensive to MITM. Put that together with new protocols that are increasingly desirable, and increasingly unavoidable, and which users will want, and you have a recipe for substantially reducing the number of companies willing to even try to MITM. > then say "You can block spam and outbound attacks without MITMing traffic." "We block outbound email ports" is not an unreasonable policy, as an example. And if someone tunnels around that, now they're spamming from their network, not yours, so it's not your fault. > How do you propose DLP gets accomplished with zero access to the network? "DLP" has become equated with "MITM". But you could, instead, focus on access to the data rather than interception of exfiltration. If people are trying to exfiltrate your data, they will find a way, very very easily. And there are much better ways to catch accidents. Also, most companies are still at the level of avoiding headlines like "laptop stolen with our whole database on it", which has nothing to do with MITM.
Spivak 6y ago
You don't have a right to know what network traffic is leaving your network from machines you own? Such an odd stance from a techie since this also applies to your Chromecast, Roku, Alexa, Laptop, Phone. Exactly zero companies care about "protecting the outside world", MITM Boxes are required to have a record and scan all traffic going through your network. If PHI is exfiltrated we can't just tell the auditor "sorry ma'am we have no visibility into our network by design. Could have been from anywhere. shrug"
- jessaustin 6y ago
  I'm sure there are auditors who would sign off on it, but you can't really claim that shitboxes prevent PHI exfil. This is like putting up a ten-foot-long fence a mile from the barn with the open door. You lost the battle the moment that data was viewed on any device that wasn't currently operated by a health professional with a reason to see it.
- fulafel 6y ago
  When those computers are used by people who you don't own, this reasoning doesn't hold.
  - Spivak 6y ago
    Kiosks?
droitbutch 6y ago
> Such networks are security threats and should be repeatedly broken until they give up. Why the hostility towards entities that have determined their best course of action to protect THEIR networks is by focusing on the network egress pipe? Simple and efficient to focus on one chokepoint vs patching a myriad of devices + client software + client versions + OS versions + future versions etc. > It will become increasingly expensive to even try. Go ahead, but you're increasingly unlikely to win that battle. There's bound to be some software or version that the enterprise cannot control (e.g. prevent data exfiltration) at which point, enterprises will have no solution but turn to SSL MITM again. Remember, it's the enterprises' network and data - not yours.
- JoshTriplett 6y ago
  > Why the hostility towards entities Among many other reasons, because such entities repeatedly try to weaken Internet security standards and software to accommodate their expectations. That's an attack, and deserves an appropriate response. Also, because today, everyone doesn't always have enough choices of potential employers that they can avoid such policies. Also, because nobody should ever get used to the idea that their network is MITMing their traffic, not least of which because that normalizes such technologies on other networks and in other contexts. Also, surveillance technologies like this will be abused by people with power over others; there's a long history of such abuse. And those are just the reasons off the top of my head. > Go ahead, you're increasingly unlikely to win that battle. What happens when libraries and software starts dropping support for old, insecure protocols, and the new protocols are designed to treat MITM as an attack? What happens when, even before that, companies that MITM have to replace cheap MITM infrastructure with incredibly expensive MITM infrastructure? What happens when software and services start treating the resulting decreasing percentage of companies that try to MITM the way they treat companies still running IE6, and tell them "you'll have to upgrade your network"? What happens when people trying to MITM find they can't run modern software stacks, and their auditors complain that they're not upgrading? What happens when they're spending huge amounts of money maintaining forks and patches? What happens when the engineers who would have to maintain those patches don't want to work on a hostile network, and the ones that remain are more expensive? There are many things people can do to make life difficult for anyone trying to MITM.

unethical_ban 6y ago

You completely ignore the concept of data breaches and preventing them. You complain about the alleged problem, "man in the middle" technologies, without any proposed solution. Let me be clear: If you do not think private companies and businesses have a right, and sometimes an obligation, to secure and monitor the traffic on their networks, then you are flat out incorrect, and this conversation can end. If you agree they need to monitor data, but that MITM technologies are a societal risk more than a benefit, I am all ears. Host-based data scanning at an OS level; signed traffic that the network can trust has been scanned by authorized hosts (so rogue hosts don't send traffic out); and so on. edit: I don't think your message is consistent, but I think that is not a sign of malice. You say "Companies have no legal or moral need to see what content is leaving their network" then say "You can block spam and outbound attacks without MITMing traffic." You seem to be equating "See the content leaving their network" with "MITM", but then say later that companies can "prevent outbound attacks" without MITM. The #1 threat for many companies is data loss. How do you propose DLP gets accomplished with zero access to the network?

kstrauser 6y ago
Your employer provides you with a medical insurance plan. On your break at work, you use your company laptop to access the insurer's website and use their find-a-doctor tool to search for a cancer doctor. This is a legitimate use of your work computer, after all. Does your employer have a right and obligation to see that you're searching for a cancer doctor? Go to a large company's IT department and find the person there you dislike the most. Do you want that person monitoring the traffic and seeing that you searched for a cancer doctor? Now you know why so very many of us believe you are completely wrong about this.
- unethical_ban 6y ago
  Do you want your bank to be hacked and have a 50GB database backup with all your accounts and transaction history slow-leaked out via DNS queries? Now you see why so many of us believe you are completely wrong about this. To your point: If it is their network, it's their network and their computer. Access the website from home, or from your phone, which isn't MITM'ed on the corporate network. If it is a resource only available on the corporate network, but it is not a "company resource" such as find-a-doctor, then you can (a) accept that the company may see it, (b) contact information security and ask if they can, or (c) find another way to get the information/complain to HR/ombudsman/whatever. It is up to the company to do the right thing when possible, which means (in our case) we don't intercept websites categorized banking, health, and a handful of others. Information security obfuscates/blocks the showing of personally identifiable logs to the rest of IT, as well. Again, banks (in my example) have an obligation to their millions of customers to protect their data, more than you have a right to browse a doctor tool or upload sensitive spreadsheets to your personal Google Drive to work on over the weekend.
- droitbutch 6y ago
  > Does your employer have a right and obligation to see that you're searching for a cancer doctor? Do you have the right to prioritize your personal activities over your employers protection of its' data? Creating blindspots on enterprise networks won't get far - especially not given today's realities of breaches.
  - 6y ago
JoshTriplett 6y ago
> You complain about the alleged problem, "man in the middle" technologies, without any proposed solution. I don't have to provide a "proposed solution" to MITM; the proposed solution is "stop that". To the extent MITM is getting harder, that means network protocols and software is getting better. This is like asking the makers of adblockers what their "proposed solution" is for ads, or asking the makers of spam filters what their "proposed solution" is for sending spam. Most critically, in a standards body, the right answer to people trying to MITM is a polite and diplomatic version of "go away, your use case is invalid". > If you do not think private companies and businesses have a right, and sometimes an obligation, to secure and monitor the traffic on their networks They can certainly try (currently), and one of the jobs of security researchers is to ensure they fail enough that they stop trying. I also hope one day that there's enough collective bargaining power among engineers that such companies cannot successfully hire people, and that nobody ever has to be desperate enough to accept such a draconian network. I'm glad I'm in a position to be able to say I'll never work for a company that requires MITM; everyone should be able to avoid that. And the only time I'm aware of a company having an obligation is due to misguided regulations on certain narrow classes of businesses. > MITM technologies are a societal risk more than a benefit The company is the only one who could possibly benefit, and that's leaving aside the likely possibility of doing more harm than good; security measures work better when your users want to help you rather than thwart you. Meanwhile, the societal harm of ever allowing MITM is massive. Right now, the biggest step I'd love to see happen is browsers (in concert) having a persistent banner for "your traffic is being MITMed" any time they're getting the wrong certificate for sites, and browsers making that impossible to remove without rebuilding the browser from source (which is a substantial barrier). Next, we can make it easy for sites to detect access from MITMed networks, and make policy decisions on that basis. Then, coalitions of sites can collectively make it expensive to MITM. Put that together with new protocols that are increasingly desirable, and increasingly unavoidable, and which users will want, and you have a recipe for substantially reducing the number of companies willing to even try to MITM. > then say "You can block spam and outbound attacks without MITMing traffic." "We block outbound email ports" is not an unreasonable policy, as an example. And if someone tunnels around that, now they're spamming from their network, not yours, so it's not your fault. > How do you propose DLP gets accomplished with zero access to the network? "DLP" has become equated with "MITM". But you could, instead, focus on access to the data rather than interception of exfiltration. If people are trying to exfiltrate your data, they will find a way, very very easily. And there are much better ways to catch accidents. Also, most companies are still at the level of avoiding headlines like "laptop stolen with our whole database on it", which has nothing to do with MITM.

Spivak 6y ago

You don't have a right to know what network traffic is leaving your network from machines you own? Such an odd stance from a techie since this also applies to your Chromecast, Roku, Alexa, Laptop, Phone. Exactly zero companies care about "protecting the outside world", MITM Boxes are required to have a record and scan all traffic going through your network. If PHI is exfiltrated we can't just tell the auditor "sorry ma'am we have no visibility into our network by design. Could have been from anywhere. shrug"

jessaustin 6y ago
I'm sure there are auditors who would sign off on it, but you can't really claim that shitboxes prevent PHI exfil. This is like putting up a ten-foot-long fence a mile from the barn with the open door. You lost the battle the moment that data was viewed on any device that wasn't currently operated by a health professional with a reason to see it.
fulafel 6y ago
When those computers are used by people who you don't own, this reasoning doesn't hold.
- Spivak 6y ago
  Kiosks?

droitbutch 6y ago

> Such networks are security threats and should be repeatedly broken until they give up. Why the hostility towards entities that have determined their best course of action to protect THEIR networks is by focusing on the network egress pipe? Simple and efficient to focus on one chokepoint vs patching a myriad of devices + client software + client versions + OS versions + future versions etc. > It will become increasingly expensive to even try. Go ahead, but you're increasingly unlikely to win that battle. There's bound to be some software or version that the enterprise cannot control (e.g. prevent data exfiltration) at which point, enterprises will have no solution but turn to SSL MITM again. Remember, it's the enterprises' network and data - not yours.

JoshTriplett 6y ago
> Why the hostility towards entities Among many other reasons, because such entities repeatedly try to weaken Internet security standards and software to accommodate their expectations. That's an attack, and deserves an appropriate response. Also, because today, everyone doesn't always have enough choices of potential employers that they can avoid such policies. Also, because nobody should ever get used to the idea that their network is MITMing their traffic, not least of which because that normalizes such technologies on other networks and in other contexts. Also, surveillance technologies like this will be abused by people with power over others; there's a long history of such abuse. And those are just the reasons off the top of my head. > Go ahead, you're increasingly unlikely to win that battle. What happens when libraries and software starts dropping support for old, insecure protocols, and the new protocols are designed to treat MITM as an attack? What happens when, even before that, companies that MITM have to replace cheap MITM infrastructure with incredibly expensive MITM infrastructure? What happens when software and services start treating the resulting decreasing percentage of companies that try to MITM the way they treat companies still running IE6, and tell them "you'll have to upgrade your network"? What happens when people trying to MITM find they can't run modern software stacks, and their auditors complain that they're not upgrading? What happens when they're spending huge amounts of money maintaining forks and patches? What happens when the engineers who would have to maintain those patches don't want to work on a hostile network, and the ones that remain are more expensive? There are many things people can do to make life difficult for anyone trying to MITM.