4 ms·
We will almost certainly block ECH at my work, as we already block DoH. I expect any sane network to do the same. The natural alternative if blocking these pro
by ocdtrekkie 3y ago
We will almost certainly block ECH at my work, as we already block DoH. I expect any sane network to do the same.
The natural alternative if blocking these protocols becomes unsustainable will absolutely be to require full decryption at our security edge. And that will provide drastically more information to us than we have now and will absolutely feel invasive.
The idea of uninspectable client traffic is somewhat unhinged, and is already heavily used by malicious actors.
- josephcsible 3y ago> I expect any sane network to do the same. Why? Sane networks shouldn't block anything. Even super dangerous stuff like ports 135-139 and 445 are a morally gray area. > The idea of uninspectable client traffic is somewhat unhinged, and is already heavily used by malicious actors. How is privacy unhinged? Isn't that basically the same as the argument that we need to gut the Fourth Amendment because of terrorists and pedophiles?
- 4death4 3y agoI don’t think morals factor in to the decision to allow / disallow traffic on a private network. That’s definitely morally neutral and to suggest otherwise is immoral.
- josephcsible 3y agoI didn't mean private networks. I meant the ISPs that do that.
- ocdtrekkie 3y agoISPs are also private networks, unless operated by a government entity. And I would absolutely uphold the same expectation from an ISP as an organizational or personal network.
- d-z-m 3y ago> And I would absolutely uphold the same expectation from an ISP as an organizational or personal network. No. ISPs provide internet service to customers who pay them for it. The entire situation is different. The ISPs are under no obligation to break and inspect encrypted traffic. Owners and operators of home and corporate networks have an entirely different(and justifiable) set of concerns.
- ocdtrekkie 3y ago[flagged]
- josephcsible 3y agoBy that logic, wouldn't every ISP have a moral obligation to MITM all of their customers' traffic? Obviously that's wrong.
- ocdtrekkie 3y agoSNI monitoring is a reasonable compromise, and I think a healthy one: Your ISP doesn't need to deep inspect your traffic to Microsoft because it accepts that Microsoft is doing something reasonable with it. It allows delegating authority which at least gives a path for investigation or blocking if necessary without seeking an extreme amount of transient information. I would say if ECH is implemented the correct response would unfortunately be to MITM it if too many providers implement it to just block it entirely. I suspect large companies won't force it to maintain a wide customer base, and again, any reasonable network operator should just block anyone who does. ISPs absolutely have all sorts of regulatory needs and network performance reasons to classify traffic. It's an unpopular view, but it's reality. (And I would encourage you to investigate who pays the people telling you otherwise, before someone links Mike Masnick here.)
- catiopatio 3y ago> SNI monitoring is a reasonable compromise, and I think a healthy one No, it’s not. ISPs have no right to know who I am speaking to or why.
- ocdtrekkie 3y agoI mean you have no right to use their networks either. You generally agree to terms as a condition of use of said networks.
- 3y ago
- jmprspret 3y ago> Why? Sane networks shouldn't block anything. Huh? What? Ever had to administer a corporate network for non-tech staff? Malware is everywhere. People are stupid. AND my assumption on a corporate network has always been that you have no expectation of privacy - its a work network, don't use it for personal stuff! Pretty simple.
- josephcsible 3y agoIf it's really a corporate network, then the company will own the endpoints and can do the inspection there.
- 3np 3y agoNot meaningfully so with ECH, the whole point of this subthread.
- capitainenemo 3y agoCorporate networks often use MITM master certs that employee browsers must accept.
- josephcsible 3y agoECH only makes network-level monitoring harder. Monitoring on the endpoint is still just as easy.
- Aaargh20318 3y ago> my assumption on a corporate network has always been that you have no expectation of privacy That certainly isn’t true in the EU. You cannot spy on employees computers without a cause.
- deleted 3y ago[deleted]
- EVa5I7bHFq9mnYK 3y ago"Malicious actors" are employees trying to visit instagram from work, right?
- ocdtrekkie 3y agoNo. https://www.bleepingcomputer.com/news/security/hackers-increasingly-abuse-cloudflare-tunnels-for-stealthy-connections/ https://www.bleepingcomputer.com/news/security/hackers-incre... The problem is that what starts as a strong desire to conduct copyright infringement (or sure, some light personal web browsing on work computers) along with a dash of free speech extremism, has turned into a militant expectation of very handy passageways for actual crimes.
- eddythompson80 3y agoI think they mean malware. Ransomware for example. Nothing wrong about locking a network down in general. Work network doesn’t have to be an open, all things go, network just so employees can instagram. Heck, there are organizations with air-gaped networks for very good reasons. Instagram on your phone while at work. Don’t expect privacy on managed work machines. You company can see your emails. They can install CA on your managed machine and MITM your https traffic. I hate the trend of also managing personal devices. But I get that it’s a complicated subject.
- 8n4vidtmkvmk 3y agoI'll be worried when I hear the first case of an employee getting in trouble for doing something innocent on corpnet. Right now I assume they can see everything while using one of their devices or on their network but they never bug us about it. They seem mostly interested in stopping malware/leaks, which seems quite reasonable.
- ocdtrekkie 3y agoAs the grandparent of this thread, I can definitely say I don't care about personal browsing on work computers. I consider that an HR issue (if it impacts their ability to do their job), not an IT issue. The ability to manage network traffic comes entirely from maintaining a secure and functional network.