3 ms·
Does mirrord not allow to connect via an encrypted protocol such as HTTPS?
by blumomo 4y ago
Does mirrord not allow to connect via an encrypted protocol such as HTTPS?
- onion2k 4y agoIf you copy prod data to a computer that's a public connection then any compromised app can exfiltrate the data. Keep data secure all the time, including when it's on a local machine. Even if the machine isn't compromised, someone could just mug you for it and then you have to start reporting the data breach. It would be... messy. To be honest, while I imagine there are times when access to prod traffic might be useful, I suspect even having a tool like this would be an instant ISO27001 or ISO27002 audit fail.
- blumomo 4y agoHow does the attack vector that you describe differ from being connected to your office or home network? Once this kind of malicious app that you describe is running on your machine, it doesn’t matter any longer what kind of network you’re connected to.
- bmm6o 4y agoThe argument is that production data should stay in production.
- blumomo 4y agoThanks, I’m now getting the point, too.
- onion2k 4y agoCoffee shop WiFi is shorthand for "any connection that isn't locked down with all unusual ports blocked in both directions, common ports blocked for outbound connections, and monitored for unusual activity." Having a compromised machine shouldn't be the end of the world; you should have layers of security that all have to fail for something bad to happen. If your approach to security is "I really hope this machine doesn't get compromised" then you're not doing a good enough job. Also, as bmm6o says, keeping prod data in your secure, pentested prod environment avoids the problem in the first place.
- blumomo 4y agoThanks, I’m now getting the point, too.