5 ms·

Many big companies have what is basically a MITM attack on SSL. They resign everything between you and the network endpoint using an enterprise certificate. It'

Many big companies have what is basically a MITM attack on SSL. They resign everything between you and the network endpoint using an enterprise certificate. It's still encrypted but at some point it's decrypted, inspected, and then re-encrypted. It's mostly seamless but sometimes you have to get a copy of the certificate to add it to things like pip.

nobody9999 5y ago
> Many big companies have what is basically a MITM attack on SSL. They resign everything between you and the network endpoint using an enterprise certificate. It's still encrypted but at some point it's decrypted, inspected, and then re-encrypted. It's mostly seamless but sometimes you have to get a copy of the certificate to add it to things like pip. Yes. And this is a good thing (in an enterprise environment) for a couple of reasons (a few others too, but these should make the point): Proxying connections is inherently more secure than packet filtering/stateful inspection; As was pointed out in another comment[0], most traffic is encrypted these days. Any traffic traversing the enterprise network needs to be visible (unencrypted) to network administrators. This allows them to identify, investigate and, potentially, block suspicious traffic. Any large organization (or even smaller ones with the need and the resources) should be able to decrypt and read every packet traversing their internal network and the ingress/egress points to/from that network. That requires ubiquitous use of proxies for all connections that have an external endpoint. It's likely that some sensitive internal networks/servers/applications should do so as well. While that's very intrusive, it's not your home network, nor is it (semi-)public wifi. It's the wholly owned property (I'm not addressing "cloud-based" resources here -- that's a different long discussion) of that organization. As such, they have every right to read every packet on their network and every byte on their storage. Which is why many organizations have "guest" networks which not only has no access to internal resources, but also only allows connections to external networks and bypasses all the proxies/firewalls as well. This allows employees, contractors and others to maintain their privacy on their own devices without impacting the security of the internal network. Of course, this requires device authentication at the network layer (e.g., 802.1x) to ensure that only authorized devices are permitted access to the internal network. None of the above is particularly new or particularly controversial. [0] https://news.ycombinator.com/item?id=30574794 https://news.ycombinator.com/item?id=30574794
- rapjr9 5y ago
  > As was pointed out in another comment[0], most traffic is encrypted these days. Any traffic traversing the enterprise network needs to be visible (unencrypted) to network administrators. Defense in depth means the network administrators do not get access to everything because if -they- are compromised then everything is compromised. So you should have multiple admins with limited power over their own subnets and turning off encryption should be like getting a warrant from a judge. This helps prevents stalking also. Network administrators are a centralized primary vulnerability that needs to be mitigated.
  - nobody9999 5y ago
    >Defense in depth means the network administrators do not get access to everything because if -they- are compromised then everything is compromised. So you should have multiple admins with limited power over their own subnets and turning off encryption should be like getting a warrant from a judge. This helps prevents stalking also. Network administrators are a centralized primary vulnerability that needs to be mitigated. A reasonable point. There certainly need to be policies and controls around who can access decrypted network traffic, as well as under what circumstances access to such traffic should be granted. However, that doesn't mean the capability to do so shouldn't be there. That said, good policies/controls can significantly mitigate the risks you addressed. Those can (and should) include separation of duties, clearly defined roles and granular access controls. What's more, you need to hire honest, decent people. Fortunately, most folks are. If one or more of your employees violates policy (and potentially the law) and exfiltrates corporate data/information, depending on severity, that employee(s) should be disciplined, fired and/or prosecuted. And "turning off encryption" isn't anything to which I described, or even alluded. Rather, I discussed using proxies to mediate connections between internal and external sides of encrypted (and unencrypted ones for that matter). connections is good security practice. >turning off encryption should be like getting a warrant from a judge. That's a ridiculous statement on its face. Organizations (and by extension, those designated by the organization to do so) have the legal right to examine all data that traverses their networks. Full stop. Edit: Correct awkward phrasing.

nobody9999 5y ago

> Many big companies have what is basically a MITM attack on SSL. They resign everything between you and the network endpoint using an enterprise certificate. It's still encrypted but at some point it's decrypted, inspected, and then re-encrypted. It's mostly seamless but sometimes you have to get a copy of the certificate to add it to things like pip. Yes. And this is a good thing (in an enterprise environment) for a couple of reasons (a few others too, but these should make the point): Proxying connections is inherently more secure than packet filtering/stateful inspection; As was pointed out in another comment[0], most traffic is encrypted these days. Any traffic traversing the enterprise network needs to be visible (unencrypted) to network administrators. This allows them to identify, investigate and, potentially, block suspicious traffic. Any large organization (or even smaller ones with the need and the resources) should be able to decrypt and read every packet traversing their internal network and the ingress/egress points to/from that network. That requires ubiquitous use of proxies for all connections that have an external endpoint. It's likely that some sensitive internal networks/servers/applications should do so as well. While that's very intrusive, it's not your home network, nor is it (semi-)public wifi. It's the wholly owned property (I'm not addressing "cloud-based" resources here -- that's a different long discussion) of that organization. As such, they have every right to read every packet on their network and every byte on their storage. Which is why many organizations have "guest" networks which not only has no access to internal resources, but also only allows connections to external networks and bypasses all the proxies/firewalls as well. This allows employees, contractors and others to maintain their privacy on their own devices without impacting the security of the internal network. Of course, this requires device authentication at the network layer (e.g., 802.1x) to ensure that only authorized devices are permitted access to the internal network. None of the above is particularly new or particularly controversial. [0] https://news.ycombinator.com/item?id=30574794 https://news.ycombinator.com/item?id=30574794

rapjr9 5y ago
> As was pointed out in another comment[0], most traffic is encrypted these days. Any traffic traversing the enterprise network needs to be visible (unencrypted) to network administrators. Defense in depth means the network administrators do not get access to everything because if -they- are compromised then everything is compromised. So you should have multiple admins with limited power over their own subnets and turning off encryption should be like getting a warrant from a judge. This helps prevents stalking also. Network administrators are a centralized primary vulnerability that needs to be mitigated.
- nobody9999 5y ago
  >Defense in depth means the network administrators do not get access to everything because if -they- are compromised then everything is compromised. So you should have multiple admins with limited power over their own subnets and turning off encryption should be like getting a warrant from a judge. This helps prevents stalking also. Network administrators are a centralized primary vulnerability that needs to be mitigated. A reasonable point. There certainly need to be policies and controls around who can access decrypted network traffic, as well as under what circumstances access to such traffic should be granted. However, that doesn't mean the capability to do so shouldn't be there. That said, good policies/controls can significantly mitigate the risks you addressed. Those can (and should) include separation of duties, clearly defined roles and granular access controls. What's more, you need to hire honest, decent people. Fortunately, most folks are. If one or more of your employees violates policy (and potentially the law) and exfiltrates corporate data/information, depending on severity, that employee(s) should be disciplined, fired and/or prosecuted. And "turning off encryption" isn't anything to which I described, or even alluded. Rather, I discussed using proxies to mediate connections between internal and external sides of encrypted (and unencrypted ones for that matter). connections is good security practice. >turning off encryption should be like getting a warrant from a judge. That's a ridiculous statement on its face. Organizations (and by extension, those designated by the organization to do so) have the legal right to examine all data that traverses their networks. Full stop. Edit: Correct awkward phrasing.