3 ms·

This article is technically shallow, not giving any detail about the protocol but instead just quoting supposed experts opinion about it. > [list of obstacles

by rixed 5y ago

This article is technically shallow, not giving any detail about the protocol but instead just quoting supposed experts opinion about it. > [list of obstacles to be overcome in deploying HTTP/3] includes getting the technology to work with (...) deep packet inspection devices How do you reconcile this with the alleged increased used security? I know that everything relying on TLS for security is already just theatre in practice but still. > the protocol is much easier than TCP to evolve/tweak and new best practices will emerge Knowing only Google and/or other $big_corp will influence those evolutions, this does not strike me as a benefit either. I can wait before facing wire level DRM enforcement, for instance.

arjvik 5y ago
> I know that everything relying on TLS for security is already just theatre in practice Could you expand on that?
- rixed 5y ago
  From what I've seen, it seems routine practice for large non-technical organisations to light-heartedly implement one of these techniques, from simplest to more elaborate: - adding a compromised certificate authority to the set of trusted ones in the clients (won't work reliably any longer for most servers I believe) - copying around the servers private keys and forcing those servers to nehociate below perfect forward secrecy so that traffic can be decrypted on the fly from many places (for when you control the servers, but still copying private keys around and decrypting at the perimeter is not great) - enforcing the use of a compromised browser/ssl lib on the client machines that will just store/forward the traffic - installing "security" agents on controlled clients that forward all session keys on the fly or optionally tunnel the whole clear traffic to another box (I know a startup whom this is the only product) I've personally been professionally involved with several of these tools at this point, even authored one, and I'm not even particularly interested in these topics, so I guess anyone working in security could bring more stories. In conclusion, I believe TLS is both too complex and too flawed to be relied upon, and is just delaying the adoption of better protocols (some with no trusted authority, mandatory anonymous clients authorisation, mandatory secure encryption, you name it, again I'm not much into this, maybe some already well known protocol fits the bill)
  - tialaramex 5y ago
    TLS delivers exactly what it promises, but organisations paid you to go to some lengths to sabotage that in clients and servers. Your theory is that this is delaying adoption of some imaginary "better protocol" but er, they would of course just go to great lengths to sabotage that too. TLS can't make you want security. The Socialist Millionaire's Protocol allows Alice and Bob to compare their fortunes to find out if they're equally wealthy without revealing who has how much. But the Protocol can't stop Alice from just blurting out "I'm worth a cool $84.6 million" if she chooses.
MattPalmer1086 5y ago
This just shows there is no one definition of security, it depends on context. TLS 1.3 prevents some types of man in the middle attack and thus blocks inline packet inspection. Certainly on the public internet this is a security win. Internally, some organizations want to monitor or forensically record network sessions.... for security! So you trade one form of security for another. Depends entirely on your security requirements.

by rixed 5y ago

arjvik 5y ago

> I know that everything relying on TLS for security is already just theatre in practice Could you expand on that?

rixed 5y ago
From what I've seen, it seems routine practice for large non-technical organisations to light-heartedly implement one of these techniques, from simplest to more elaborate: - adding a compromised certificate authority to the set of trusted ones in the clients (won't work reliably any longer for most servers I believe) - copying around the servers private keys and forcing those servers to nehociate below perfect forward secrecy so that traffic can be decrypted on the fly from many places (for when you control the servers, but still copying private keys around and decrypting at the perimeter is not great) - enforcing the use of a compromised browser/ssl lib on the client machines that will just store/forward the traffic - installing "security" agents on controlled clients that forward all session keys on the fly or optionally tunnel the whole clear traffic to another box (I know a startup whom this is the only product) I've personally been professionally involved with several of these tools at this point, even authored one, and I'm not even particularly interested in these topics, so I guess anyone working in security could bring more stories. In conclusion, I believe TLS is both too complex and too flawed to be relied upon, and is just delaying the adoption of better protocols (some with no trusted authority, mandatory anonymous clients authorisation, mandatory secure encryption, you name it, again I'm not much into this, maybe some already well known protocol fits the bill)
- tialaramex 5y ago
  TLS delivers exactly what it promises, but organisations paid you to go to some lengths to sabotage that in clients and servers. Your theory is that this is delaying adoption of some imaginary "better protocol" but er, they would of course just go to great lengths to sabotage that too. TLS can't make you want security. The Socialist Millionaire's Protocol allows Alice and Bob to compare their fortunes to find out if they're equally wealthy without revealing who has how much. But the Protocol can't stop Alice from just blurting out "I'm worth a cool $84.6 million" if she chooses.

MattPalmer1086 5y ago

This just shows there is no one definition of security, it depends on context. TLS 1.3 prevents some types of man in the middle attack and thus blocks inline packet inspection. Certainly on the public internet this is a security win. Internally, some organizations want to monitor or forensically record network sessions.... for security! So you trade one form of security for another. Depends entirely on your security requirements.