4 ms·

TLS mitigates against someone evil on the network to some extent. It is possible to snoop inside TLS connections in a variety of ways for a variety of reasons.

TLS mitigates against someone evil on the network to some extent. It is possible to snoop inside TLS connections in a variety of ways for a variety of reasons. If you care about your data you should client side encrypt it before you send it.

josephcsible 5y ago
This makes no sense at all. TLS encryption does happen on the client side.
- beermonster 5y ago
  Actually TLS happens client and server side and protects data in transit whilst established. But that means over the network. If you want to protect the actual contents you should encrypt it within your application and not rely on the TLS layer to protect it as various products, tools and services strip off this layer (for better or worse) Lots of people think you can protect your data just by using TLS which is false. If you don’t believe that try using mitmproxy or fiddler.
  - josephcsible 5y ago
    > If you don’t believe that try using mitmproxy or fiddler. But those will give a TLS error unless the endpoint is already pwned.
    - beermonster 5y ago
      Fiddler uses a certificate which you need to trust to intercept traffic. Enterprises also do this type of thing on a larger scale (see products from Bluecoat for e.g.) to monitor employees and for detecting exfiltration of data. Of course outside of the enterprise phishers will use a variety of other tricks as they are not in control of your CA list you trust (as you mention here) on your device. So they’ll for e.g. use domain names that either look legit or are very close to a real domain.
      - josephcsible 5y ago
        If your enterprise has enough control over your endpoint to add a trusted root CA to it, then they could also just read all of your private data right out of your RAM. Lookalike domain names don't imply that TLS is broken. The guarantee from TLS is that you're talking to the owner of the domain you connect to, which is still true if you connect to the wrong one.

josephcsible 5y ago

This makes no sense at all. TLS encryption does happen on the client side.

beermonster 5y ago
Actually TLS happens client and server side and protects data in transit whilst established. But that means over the network. If you want to protect the actual contents you should encrypt it within your application and not rely on the TLS layer to protect it as various products, tools and services strip off this layer (for better or worse) Lots of people think you can protect your data just by using TLS which is false. If you don’t believe that try using mitmproxy or fiddler.
- josephcsible 5y ago
  > If you don’t believe that try using mitmproxy or fiddler. But those will give a TLS error unless the endpoint is already pwned.
  - beermonster 5y ago
    Fiddler uses a certificate which you need to trust to intercept traffic. Enterprises also do this type of thing on a larger scale (see products from Bluecoat for e.g.) to monitor employees and for detecting exfiltration of data. Of course outside of the enterprise phishers will use a variety of other tricks as they are not in control of your CA list you trust (as you mention here) on your device. So they’ll for e.g. use domain names that either look legit or are very close to a real domain.
    - josephcsible 5y ago
      If your enterprise has enough control over your endpoint to add a trusted root CA to it, then they could also just read all of your private data right out of your RAM. Lookalike domain names don't imply that TLS is broken. The guarantee from TLS is that you're talking to the owner of the domain you connect to, which is still true if you connect to the wrong one.