4 ms·

As someone (thankfully) not in the loop with these enterprise tools, what exactly is the issue? How did it work before (and what have changed)? Can't enterpris

As someone (thankfully) not in the loop with these enterprise tools, what exactly is the issue? How did it work before (and what have changed)? Can't enterprises just MITM the traffic and sign it with a CA the clients trust? What's the benefit of the previous solutions?

dilyevsky 3y ago
As far I understand the issue is encryped client hello. > Can't enterprises just MITM the traffic and sign it with a CA the clients trust? What's the benefit of the previous solutions? This wont work with cert pinning and also is a lot more expensive
- Avamander 3y ago
  Boo-hoo? If it's not your endpoint then it's not yours to intercept and analyze?
  - dilyevsky 3y ago
    Did you miss the part where it says “enterprise”?
    - Avamander 3y ago
      I certainly can't see the part where saying "enterprise" should grant me the right to intercept and analyse someone's traffic.
deleted 3y ago
[deleted]
tptacek 3y ago
By way of example: TLS 1.3 eliminated the RSA key exchange, which breaks passive decryption of TLS, which was a common enterprise security technique.
- filleokus 3y ago
  Hmm, thanks. But that only works when the passive eavesdropper has the server private key (right?). That seems quite limiting if you want to have "visibility" into network traffic? I don't really understand the full picture / use case here. Is it only for internal traffic, or is it used in combination with some other more active mitm method to act as the server even for e.g gmail.com?
  - tptacek 3y ago
    Yes.
ngrilly 3y ago
> Can't enterprises just MITM the traffic and sign it with a CA the clients trust? This is what Zscaler is doing. I know because my company was (unfortunately) using this.
- Avamander 3y ago
  > ZScaler Awful company with 0 protections against being abused. They can't handle stopping a DDoS originating from their service I can't imagine them being trustworthy for a full MiTM.

dilyevsky 3y ago

As far I understand the issue is encryped client hello. > Can't enterprises just MITM the traffic and sign it with a CA the clients trust? What's the benefit of the previous solutions? This wont work with cert pinning and also is a lot more expensive

Avamander 3y ago
Boo-hoo? If it's not your endpoint then it's not yours to intercept and analyze?
- dilyevsky 3y ago
  Did you miss the part where it says “enterprise”?
  - Avamander 3y ago
    I certainly can't see the part where saying "enterprise" should grant me the right to intercept and analyse someone's traffic.

deleted 3y ago

[deleted]

tptacek 3y ago

By way of example: TLS 1.3 eliminated the RSA key exchange, which breaks passive decryption of TLS, which was a common enterprise security technique.

filleokus 3y ago
Hmm, thanks. But that only works when the passive eavesdropper has the server private key (right?). That seems quite limiting if you want to have "visibility" into network traffic? I don't really understand the full picture / use case here. Is it only for internal traffic, or is it used in combination with some other more active mitm method to act as the server even for e.g gmail.com?
- tptacek 3y ago
  Yes.

ngrilly 3y ago

> Can't enterprises just MITM the traffic and sign it with a CA the clients trust? This is what Zscaler is doing. I know because my company was (unfortunately) using this.

Avamander 3y ago
> ZScaler Awful company with 0 protections against being abused. They can't handle stopping a DDoS originating from their service I can't imagine them being trustworthy for a full MiTM.