16 ms·

Surprising that schools are requiring additional certs to be added a a device for internet access. This enables "keybridging" mitm attacks on any TLS connectio

by chasil 5y ago

Surprising that schools are requiring additional certs to be added a a device for internet access. This enables "keybridging" mitm attacks on any TLS connection that trusts the cert. Best load a 3rd-party browser and install it locally, rather than compromise the whole device. https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/ https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...

slumdev 5y ago
It's not really surprising. Breaking PKI by installing fake CA certs so that IT can MITM every connection is now an Enterprise Best Practice (tm). In case the sarcasm isn't evident, please read the above as sarcastic. I detest admins who do this.
- abestic9 5y ago
  There is a fine line between doing this to protect IP and actual privacy abuse - and as we're treading it's important to remember how important context is. This is absolutely a best practice in some corporate environments for DLP. There's no better way to ensure sensitive data isn't being exported via TLS connections. There is no reason, however, to do this to a child's device. Their teacher and their parents should have a grasp on this, not a school IT department, third-party contractor, government or worse.
  - slumdev 5y ago
    > This is absolutely a best practice in some corporate environments for DLP. No, it's not, and this attitude is a major cause of resentment among technical employees. The "DLP" industry, in general, is a solution in search of a cause. If you can't trust your employees, you'll never be able to stop the determined ones.
easton 5y ago
Of course, that means you can’t use the school’s Wi-Fi since now every site with https won’t let you pass. Just install the cert on one device (either school issued or Firefox on a BYOD device since it keeps its own cert store that doesn’t affect the rest of the system) and use that for browsing on school Wi-Fi if your paranoid. In my experience, school IT has other things to do than to watch what your browsing without cause. (Yes, this practice sucks. But it’s the only way for them to implement the legally mandated filtering in a way they can guarantee it is working.)
- fulafel 5y ago
  Or use a VPN.
- tyingq 5y ago
  I'm curious what loophole will remain if/when ESNI/ECH + DNS-over-https starts becoming widespread. I guess they will have to install client-side snooping software.
throaway961 5y ago
An Australian state has intentions to do this soon: https://www.mediafire.com/file/ie8d45vk35bwimg/Filtered+Internet+Browsing+-+SSL+Interception+and+Decryption_redacted.pdf/file https://www.mediafire.com/file/ie8d45vk35bwimg/Filtered+Inte...

by chasil 5y ago

slumdev 5y ago

It's not really surprising. Breaking PKI by installing fake CA certs so that IT can MITM every connection is now an Enterprise Best Practice (tm). In case the sarcasm isn't evident, please read the above as sarcastic. I detest admins who do this.

abestic9 5y ago
There is a fine line between doing this to protect IP and actual privacy abuse - and as we're treading it's important to remember how important context is. This is absolutely a best practice in some corporate environments for DLP. There's no better way to ensure sensitive data isn't being exported via TLS connections. There is no reason, however, to do this to a child's device. Their teacher and their parents should have a grasp on this, not a school IT department, third-party contractor, government or worse.
- slumdev 5y ago
  > This is absolutely a best practice in some corporate environments for DLP. No, it's not, and this attitude is a major cause of resentment among technical employees. The "DLP" industry, in general, is a solution in search of a cause. If you can't trust your employees, you'll never be able to stop the determined ones.

easton 5y ago

Of course, that means you can’t use the school’s Wi-Fi since now every site with https won’t let you pass. Just install the cert on one device (either school issued or Firefox on a BYOD device since it keeps its own cert store that doesn’t affect the rest of the system) and use that for browsing on school Wi-Fi if your paranoid. In my experience, school IT has other things to do than to watch what your browsing without cause. (Yes, this practice sucks. But it’s the only way for them to implement the legally mandated filtering in a way they can guarantee it is working.)

fulafel 5y ago
Or use a VPN.
tyingq 5y ago
I'm curious what loophole will remain if/when ESNI/ECH + DNS-over-https starts becoming widespread. I guess they will have to install client-side snooping software.

throaway961 5y ago

An Australian state has intentions to do this soon: https://www.mediafire.com/file/ie8d45vk35bwimg/Filtered+Internet+Browsing+-+SSL+Interception+and+Decryption_redacted.pdf/file https://www.mediafire.com/file/ie8d45vk35bwimg/Filtered+Inte...