3 ms·

How hard it would be silently push an update to redirect all google traffic through VPN. We have already seen them trying to get google search query and results

How hard it would be silently push an update to redirect all google traffic through VPN. We have already seen them trying to get google search query and results. And why stop at Google basically they can do any website they want.

barsonme 4y ago
They’re not magic. They can’t peek into the TLS connection between your browser and google.com.
- tekknik 4y ago
  Conversely many people here think TLS is magic and unhackable, but it is not.
  - barsonme 4y ago
    I’m not sure what you mean. Do you know how to break TLS?
    - tekknik 4y ago
      Yes a MITM attack. Exactly what cloudflare does to provide their services over TLS.
      - barsonme 4y ago
        But that’s not a problem with TLS any more than you giving out your AES keys is a problem with AES.
        tekknik 4y ago
        I’m not sure even how to respond to this. If a protocol is weak due to a flaw, like being susceptible to MITM attacks, then yes it is a problem with the protocol. This is exactly my point. People are desperate for there to be no flaws in TLS, so much so they ignore MITM attacks.
tsimionescu 4y ago
The only way they can do that is at the client level, not the network level. Whether it's running over a VPN or not, your traffic to Google is TLS, so you have an excellent guarantee that it's impossible to snoop on the contents of your HTTP requests at the network level. However, you are using a Microsoft client and/or a Microsoft OS to do this - and of course, if they want to, Edge or even Windows itself can report on the input and output of any operation you make, regardless of any network security. Similarly, WhatsApp or Signal or iMessage or Android/iOS could send a copy of the plain text of any messages you send or receive to home base despite them being E2E encrypted on the wire. You always have to trust the device and client software you are using to access the internet. So, if you personally don't trust Microsoft not to snoop on your traffic with Google, using Edge or Windows is completely wrong.
- tekknik 4y ago
  > your traffic to Google is TLS, so you have an excellent guarantee that it's impossible to snoop on the contents of your HTTP requests at the network level. It’s definitely not impossible, MITM attacks work for TLS and this is exactly how cloudflare work (it MITMs TLS sites by terminating the tunnel and recreating.). TLS is only secure if you have pinned certs.
  - tsimionescu 4y ago
    MITM for TLS only works if you have the cooperation of the server owner (like Cloudflare does, or illegally be stealing the server owner private keys) or a malicious CA, or if you ignore the security errors that the browser offers. Otherwise, TLS is completely impervious to MITM attacks as a protocol. Of course, various implementations of TLS may also have exploitable vulnerabilities.
    - tekknik 4y ago
      I’m not sure what you refuted here, you seem to have said exactly the same thing I did.

barsonme 4y ago

They’re not magic. They can’t peek into the TLS connection between your browser and google.com.

tekknik 4y ago
Conversely many people here think TLS is magic and unhackable, but it is not.
- barsonme 4y ago
  I’m not sure what you mean. Do you know how to break TLS?
  - tekknik 4y ago
    Yes a MITM attack. Exactly what cloudflare does to provide their services over TLS.
    - barsonme 4y ago
      But that’s not a problem with TLS any more than you giving out your AES keys is a problem with AES.
      - tekknik 4y ago
        I’m not sure even how to respond to this. If a protocol is weak due to a flaw, like being susceptible to MITM attacks, then yes it is a problem with the protocol. This is exactly my point. People are desperate for there to be no flaws in TLS, so much so they ignore MITM attacks.

tsimionescu 4y ago

The only way they can do that is at the client level, not the network level. Whether it's running over a VPN or not, your traffic to Google is TLS, so you have an excellent guarantee that it's impossible to snoop on the contents of your HTTP requests at the network level. However, you are using a Microsoft client and/or a Microsoft OS to do this - and of course, if they want to, Edge or even Windows itself can report on the input and output of any operation you make, regardless of any network security. Similarly, WhatsApp or Signal or iMessage or Android/iOS could send a copy of the plain text of any messages you send or receive to home base despite them being E2E encrypted on the wire. You always have to trust the device and client software you are using to access the internet. So, if you personally don't trust Microsoft not to snoop on your traffic with Google, using Edge or Windows is completely wrong.

tekknik 4y ago
> your traffic to Google is TLS, so you have an excellent guarantee that it's impossible to snoop on the contents of your HTTP requests at the network level. It’s definitely not impossible, MITM attacks work for TLS and this is exactly how cloudflare work (it MITMs TLS sites by terminating the tunnel and recreating.). TLS is only secure if you have pinned certs.
- tsimionescu 4y ago
  MITM for TLS only works if you have the cooperation of the server owner (like Cloudflare does, or illegally be stealing the server owner private keys) or a malicious CA, or if you ignore the security errors that the browser offers. Otherwise, TLS is completely impervious to MITM attacks as a protocol. Of course, various implementations of TLS may also have exploitable vulnerabilities.
  - tekknik 4y ago
    I’m not sure what you refuted here, you seem to have said exactly the same thing I did.