5 ms·

If you are wondering why they do this, the answer is not because they don’t trust TLS. It is (likely) because they use geographically distributed terminating l

If you are wondering why they do this, the answer is not because they don’t trust TLS. It is (likely) because they use geographically distributed terminating load balancers, perhaps owned by someone else or run in someone else’s POP, and are trying to prevent passive collection of passwords.

gruez 6y ago
I guses that works, but it only really prevents surreptitious password collection. If you're in a position to do active attacks (eg. MITM), you can just substitute their public key with your own.
- lights0123 6y ago
  For sure, but it's at least possible for them to set up a honeypot to detect that.
  - gruez 6y ago
    Yeah that prevents mass surveillance but doesn't prevent targeted surveillance (think steam account with valuable skins).
    - noobquestion81 6y ago
      The stakes are “we lost all the user passwords”. This is a problem that can occur if e.g. the POP is logging too many things. Preventing passive collection at POPs also prevents all sorts of footguns like these that can lead to a breach, it is smart security sense IMO.
- est31 6y ago
  You might be "only" admin of such a MITM box and can maybe only see/search the decrypted contents but not alter them.
nijave 6y ago
This would also cover intercepting proxies like many corporate networks have and potentially protect against less technical malware that installs MITM proxies on the local computer and root CAs to intercept local traffic (not sure if this is still a common type of malware on Windows computers but I've seen it before)
mminer237 6y ago
I'm assuming it's more that they used to support logging in without SSL, and they just never saw a reason to put in work to change the login to get rid of extra security once HTTPS became mandatory.
- jaywalk 6y ago
  Except that without SSL, some JavaScript could be injected to grab the password completely outside of the RSA encryption. So assuming there is already a MITM who wants the password, all you'd be doing is making his attack slightly more complicated.
  - mlyle 6y ago
    Those geographically distributed SSL-terminating load balancers could still conduct such an attack, SSL or not.
    - jaywalk 6y ago
      Yep. If any sort of MITM attack was their motivation for this, they didn't really think it through.
      - crdrost 6y ago
        The passive collection case is presumably enough to justify it. Like, after those folks who were sniffing Facebook and MySpace cookies on unsecured WiFi routers were caught, I can imagine pushing for something like this, "just to force them to single us out and perform an active attack on us, which most passive WiFi sniffers are likely not willing to do," or so. Another separate derivation would be: “we log every single call. period. I will take on whatever cost to have that oversight of my system.” Well that's problematic, dr. boss, because several calls have PII in them and we want to be careful with how we store that. "OK, we encrypt the PII in-transit so that our logging doesn't have access to it." Well OK but our “log everything” philosophy is now also logging the keys that it was encrypted with, which the client has to fetch. Every call, right? So we are still storing the PII for any hacker to decrypt. "Well, let’s use asymmetric encryption so that this information is not sufficient to decrypt.” OK, but I can still connect information about how you were playing this game at this time, to how you were playing that game at that time. The logs contain that second-order PII that exists in correlations because you use a deterministic process to encrypt. (And at this point the obvious thing to do is a nondeterministic encryption process but you can also just rotate the keys periodically to make this sort of correlation only work over very short timescales.) Just saying, HTTPS assumes that the problem is insecure channels between secure endpoints when the problem can also be at one or the other endpoint. Like another person said, you might also decrypt right before a load balancer and then route the sensitive data to some other data center because it has lower overall load, etc. etc.
yuliyp 6y ago
It also potentially protects the passwords from their web servers if they implement it like that. They can pass the encrypted password to a separate service that has the private key and decides to give you a session or not.
deleted 6y ago
[deleted]

gruez 6y ago

I guses that works, but it only really prevents surreptitious password collection. If you're in a position to do active attacks (eg. MITM), you can just substitute their public key with your own.

lights0123 6y ago
For sure, but it's at least possible for them to set up a honeypot to detect that.
- gruez 6y ago
  Yeah that prevents mass surveillance but doesn't prevent targeted surveillance (think steam account with valuable skins).
  - noobquestion81 6y ago
    The stakes are “we lost all the user passwords”. This is a problem that can occur if e.g. the POP is logging too many things. Preventing passive collection at POPs also prevents all sorts of footguns like these that can lead to a breach, it is smart security sense IMO.
est31 6y ago
You might be "only" admin of such a MITM box and can maybe only see/search the decrypted contents but not alter them.

nijave 6y ago

This would also cover intercepting proxies like many corporate networks have and potentially protect against less technical malware that installs MITM proxies on the local computer and root CAs to intercept local traffic (not sure if this is still a common type of malware on Windows computers but I've seen it before)

mminer237 6y ago

I'm assuming it's more that they used to support logging in without SSL, and they just never saw a reason to put in work to change the login to get rid of extra security once HTTPS became mandatory.

jaywalk 6y ago
Except that without SSL, some JavaScript could be injected to grab the password completely outside of the RSA encryption. So assuming there is already a MITM who wants the password, all you'd be doing is making his attack slightly more complicated.
- mlyle 6y ago
  Those geographically distributed SSL-terminating load balancers could still conduct such an attack, SSL or not.
  - jaywalk 6y ago
    Yep. If any sort of MITM attack was their motivation for this, they didn't really think it through.
    - crdrost 6y ago
      The passive collection case is presumably enough to justify it. Like, after those folks who were sniffing Facebook and MySpace cookies on unsecured WiFi routers were caught, I can imagine pushing for something like this, "just to force them to single us out and perform an active attack on us, which most passive WiFi sniffers are likely not willing to do," or so. Another separate derivation would be: “we log every single call. period. I will take on whatever cost to have that oversight of my system.” Well that's problematic, dr. boss, because several calls have PII in them and we want to be careful with how we store that. "OK, we encrypt the PII in-transit so that our logging doesn't have access to it." Well OK but our “log everything” philosophy is now also logging the keys that it was encrypted with, which the client has to fetch. Every call, right? So we are still storing the PII for any hacker to decrypt. "Well, let’s use asymmetric encryption so that this information is not sufficient to decrypt.” OK, but I can still connect information about how you were playing this game at this time, to how you were playing that game at that time. The logs contain that second-order PII that exists in correlations because you use a deterministic process to encrypt. (And at this point the obvious thing to do is a nondeterministic encryption process but you can also just rotate the keys periodically to make this sort of correlation only work over very short timescales.) Just saying, HTTPS assumes that the problem is insecure channels between secure endpoints when the problem can also be at one or the other endpoint. Like another person said, you might also decrypt right before a load balancer and then route the sensitive data to some other data center because it has lower overall load, etc. etc.

yuliyp 6y ago

It also potentially protects the passwords from their web servers if they implement it like that. They can pass the encrypted password to a separate service that has the private key and decides to give you a session or not.

deleted 6y ago

[deleted]