4 ms·

Biggest problem with current "Zero Trust" implementations is they imply a full surveillance of employees' Internet traffic including man-in-the-middling their e

Biggest problem with current "Zero Trust" implementations is they imply a full surveillance of employees' Internet traffic including man-in-the-middling their encrypted SSL requests. My company just deployed "ZScaler" -- a product marketed as a "zero trust" VPN solution but in actuality is an Orwellian surveillance tool. This will give "zero trust" a nice negative connotation very soon.

helloooooooo 4y ago
A lot of the time, SSL MITM proxies are used as a mechanism to detect malicious content within a corporate content. I have seen, deployed across millions of machines, prevent phishing documents from being detonated thousands of times.
gatkinso 4y ago
more like - 'zero trust' in the sense you cannot trust it
AaronFriel 4y ago
Single point of failure devices for decryption of traffic (MitM) is not in line with the original definition of "zero trust", and VPNs certainly aren't either. Zero trust arose out of this exact sort of scenario following the Snowden leaks and the NSA document showing "SSL added and removed here". End to end encryption and removing MitM middleboxes was the answer to SSL intercepting proxies. This is a VPN/SSL interception product attempting to remain relevant by advertising as something it isn't.
zemnmez 4y ago
i’m not really sure what you mean. most of these products are indeed reverse-proxies, but reverse proxies do not sit in front of the whole internet, just corporate services
zmmmmm 4y ago
ZScaler has coopted the term Zero Trust for marketing purposes. Their SSL interception tool is branded as part of their Zero Trust but is antithetical to the principles of zero trust ... in fact, IMHO anybody who deploys it is further away from achieving Zero Trust than before they started - instead of users authenticating using individually secured transactions to every TLS endpoint they connect to, it is all centralized in ZScaler which is ubiquitously trusted across the organisation. This is a centralizing of the trust model that is the opposite of the intent of Zero Trust. I hope ZScaler gets shamed into modifying or removing some of this branding (or alternatively sued when one of their customers gets attacked or fails an audit after believing it ...)

helloooooooo 4y ago

A lot of the time, SSL MITM proxies are used as a mechanism to detect malicious content within a corporate content. I have seen, deployed across millions of machines, prevent phishing documents from being detonated thousands of times.

gatkinso 4y ago

more like - 'zero trust' in the sense you cannot trust it

AaronFriel 4y ago

Single point of failure devices for decryption of traffic (MitM) is not in line with the original definition of "zero trust", and VPNs certainly aren't either. Zero trust arose out of this exact sort of scenario following the Snowden leaks and the NSA document showing "SSL added and removed here". End to end encryption and removing MitM middleboxes was the answer to SSL intercepting proxies. This is a VPN/SSL interception product attempting to remain relevant by advertising as something it isn't.

zemnmez 4y ago

i’m not really sure what you mean. most of these products are indeed reverse-proxies, but reverse proxies do not sit in front of the whole internet, just corporate services

zmmmmm 4y ago

ZScaler has coopted the term Zero Trust for marketing purposes. Their SSL interception tool is branded as part of their Zero Trust but is antithetical to the principles of zero trust ... in fact, IMHO anybody who deploys it is further away from achieving Zero Trust than before they started - instead of users authenticating using individually secured transactions to every TLS endpoint they connect to, it is all centralized in ZScaler which is ubiquitously trusted across the organisation. This is a centralizing of the trust model that is the opposite of the intent of Zero Trust. I hope ZScaler gets shamed into modifying or removing some of this branding (or alternatively sued when one of their customers gets attacked or fails an audit after believing it ...)