4 ms·
It's only benign if we don't see new policies that say "everyone must disable keystroke obfuscation so we can still spy on traffic". If a company's security st
by cyrnel 3y ago
It's only benign if we don't see new policies that say "everyone must disable keystroke obfuscation so we can still spy on traffic".
If a company's security strategy relies on the ability to tell if a given stream of encrypted bytes is shell traffic, and that it can be fooled by timing obfuscation, they need a better strategy. Attackers won't care to follow a "no timing obfuscation" policy.
- hedora 3y agoI've definitely encountered security teams that thrash between different broken policies. For instance, one employer simultaneously had these two policies: - All developer laptops must be able to log into prod - You must type a 2FA pin each time you access the test environment, and that includes nightly automation scripts. I imagine they'd love to run a thing that detected and blocked scripted access to the test environment, but allowed it in production. (In case it isn't obvious, I agree that corporate security teams shouldn't use strange network monitoring heuristics to interfere with common engineering and ops workflows.)