5 ms·
By the same logic HTTPS is bypassing your network filtering of every service which happens to have an alternative available over HTTPS. So do you block HTTPS?
by shawnz 6y ago
By the same logic HTTPS is bypassing your network filtering of every service which happens to have an alternative available over HTTPS. So do you block HTTPS?
- fiddlerwoaroof 6y agoI’ve been thinking about installing a proxy with my own root for this reason.
- deleted 6y ago[deleted]
- shawnz 6y agoI would not want to use your network if that was the case, and I wonder if you similarly would use someone else's network if it was configured like that. I don't think network operators who provide access to the Internet can realistically expect to control what their users do on the Internet, unless the network operator is also the administrator of those workstations.
- fiddlerwoaroof 6y agoMaybe, but my rule is: my home network, my rules. I can’t really do this invisibly anyways: any device I don’t control will get certificate validation errors.
- syshum 6y agoThe problem here is even the device owner is not the "administrator" of the device as we have lost ownership rights, locked behind EULA's, Patents and copyright The point of the original story is "your" meaning a device you own, is ignoring your network controls it is highly unlikely that the TV manufacturer is going to allow me to install my own custom root certs to inspect their traffic to HTTPS, so yes DoH and other things are a threat to network security, because if the TV become compromised I have limited administrative controls to prevent it other the blocking it completely which is a poor response to the problem DoH is a solution in search of a problem that can be solves in better more user friendly ways
- acdha 6y agoThey could do that any time without DoH, as has been done for years. Your true choice is allowing network access or not.
- throwaway201103 6y agoYes, from your IoT devices maybe you do. The usual approach to setting up a firewall is a default of "block everything" and then selectively allow only what is needed. Most people cheat and only do this on inbound connections, allowing everything on the egress side, because it's easier. But if you want to block your IoT devices from making outbound https connections, you easily can. There's nothing really new going on here. It's always been possible to tunnel one protocol over another, or use nonstandard ports, and use encryption on the traffic to hide what you're doing.
- LanternLight83 6y agoI would absolutely love to have control over HTTPS traffic on my network, specifically to enable my Squid proxy to cache HTTPS pages, but unfortunately not every device or even program supports custom CA's. I'd be the man-in-the-middle between the internet and every device I own.
- shawnz 6y agoI think that is a pretty user-hostile attitude and I suspect you probably wouldn't really love it if every network operator was doing that kind of thing.
- fiddlerwoaroof 6y agoWhat’s user-hostile is every consumer device insisting on pushing its defaults and ignoring any network policies I’ve configured.
- shawnz 6y agoYes, I agree that is also user-hostile, since it should be configurable. The problem is not about network policies though, since DHCP is explicitly not designed to be a policy and is purposely meant to be optional for the client. For this reason I wouldn't recommend buying a device like the Chromecast, in which the user can't configure the network settings. Instead maybe consider something like the Amazon Fire Stick which is not as user-hostile.
- mrmanner 6y agoI read that as LanternLight83 is both the network operator and the user in this case, and if so it’s not really a problem. I would also love to MitM myself in some cases, mostly because it’d be interesting to see what’s going on.
- shawnz 6y agoYes, but my point is that if you feel it's justified for your own network then you ought to expect every other network operator will feel that way about their network too. So before applying that mentality, it would be wise to consider what your experience would be like if all your neighbours, friends, colleagues etc also did that on their networks.