5 ms·
Well, rephrased, what I am led to believe is that Websense can read HTTPS traffic without sparking a certificate warning. I don't have details on that, unfortu
by pnathan 15y ago
Well, rephrased, what I am led to believe is that Websense can read HTTPS traffic without sparking a certificate warning.
I don't have details on that, unfortunately.
- tptacek 15y agoIt is crazy that you're even entertaining the thought that the entire security model of the world wide web has been circumvented by WebSense. I guess they just really know how to keep a secret?
- pnathan 15y agoI am a little confused by the disparity between your statements and the statements here: http://security.stackexchange.com/questions/2914/can-my-company-see-what-https-sites-i-went-to http://security.stackexchange.com/questions/2914/can-my-comp... It sounds pretty clear to me that with some work on the adversary's part and lack of checking of the certificate chain, TLS can be subverted.
- tptacek 15y agoYes, if you don't check certificates you can subvert TLS. Also if you key your ciphers with zeroes. Don't do those things.
- count 15y agoWebsense doesn't break TLS or SSL or PKI. Websense abuses an organizations control over their own workstations to conduct a 'mitm' or 'proxy' of the TLS connection. It does that in a fairly straight forward manner. Websense is used in organizations that distribute their own root ca key to the workstations behind it. The Websense machine is then given that root ca key and allowed to generate dynamic certs with it, so that a workstation with your organizational CA trusts them, but nobody on the regular inter webs will. It's a really, really shitty way to do things, and effectively violates the trust of every user on your corporate network, but hey, they signed an agreement.
- pnathan 15y agoThank you for the information.