3 ms·

I thought these “lawful intercept” organisations had their taps inside the data centers after https tsl to the user had already been terminated. And so the infa

by totetsu 11mo ago

I thought these “lawful intercept” organisations had their taps inside the data centers after https tsl to the user had already been terminated. And so the infamous ssl removed here slide from prism.

ErroneousBosh 11mo ago
> I thought these “lawful intercept” organisations had their taps inside the data centers after https tsl to the user had already been terminated. How would that actually work? TLS runs on the client and the server. There's no "TLS magic box" in between.
- totetsu 11mo ago
  https://docs.nginx.com/nginx/admin-guide/security-controls/terminating-ssl-http/ https://docs.nginx.com/nginx/admin-guide/security-controls/t... Like let’s say you have a proxy server like Nginx on a server with a public facing ip address and then it also has access to a private subnet where your application servers are running. A visitor to your website’s browser make a secure https connection the nginx server where https would be terminated and then it would proxy traffic in plain http over your internal private subnet to the app server. And your are in a five eyes country where your intelligence services took it on themselves to follow the nsa or fbis instructions and plug a network device into those private subnets of all the big service providers inside their datacenters that is configured in something like a promiscuous way so it receives all the packets for any device on the network. Then those packets somehow end up in a big nsa datalake.. or something along those lines
  - ErroneousBosh 11mo ago
    But the private subnet does not leave your server.
    - Tuna-Fish 11mo ago
      For large sites, the private subnet is an actual network, with dozens or potentially hundreds of machines on it. (Or was, back then. These days you can probably collapse all of that into a single medium-sized epyc or something.)
      - ErroneousBosh 11mo ago
        > (Or was, back then. These days you can probably collapse all of that into a single medium-sized epyc or something.) I know where there are Sun V880s still running Oracle databases in a biggish cluster. Their processor power, memory capacity, and storage capacity are exactly equivalent to a Raspberry Pi 4 with a biggish SD card. We have come a long way.
  - lupire 11mo ago
    That's a fancy of way of saying "not using HTTPS" which may be what average incompetent shops were doing, but isn't using HTTP everywhere which is the security standard.
- jopsen 11mo ago
  > TLS runs on the client and the server. There's no "TLS magic box" in between. If there was it'd be called Cloudflare :)
  - ErroneousBosh 11mo ago
    Too soon :-D

by totetsu 11mo ago

ErroneousBosh 11mo ago

> I thought these “lawful intercept” organisations had their taps inside the data centers after https tsl to the user had already been terminated. How would that actually work? TLS runs on the client and the server. There's no "TLS magic box" in between.

totetsu 11mo ago
https://docs.nginx.com/nginx/admin-guide/security-controls/terminating-ssl-http/ https://docs.nginx.com/nginx/admin-guide/security-controls/t... Like let’s say you have a proxy server like Nginx on a server with a public facing ip address and then it also has access to a private subnet where your application servers are running. A visitor to your website’s browser make a secure https connection the nginx server where https would be terminated and then it would proxy traffic in plain http over your internal private subnet to the app server. And your are in a five eyes country where your intelligence services took it on themselves to follow the nsa or fbis instructions and plug a network device into those private subnets of all the big service providers inside their datacenters that is configured in something like a promiscuous way so it receives all the packets for any device on the network. Then those packets somehow end up in a big nsa datalake.. or something along those lines
- ErroneousBosh 11mo ago
  But the private subnet does not leave your server.
  - Tuna-Fish 11mo ago
    For large sites, the private subnet is an actual network, with dozens or potentially hundreds of machines on it. (Or was, back then. These days you can probably collapse all of that into a single medium-sized epyc or something.)
    - ErroneousBosh 11mo ago
      > (Or was, back then. These days you can probably collapse all of that into a single medium-sized epyc or something.) I know where there are Sun V880s still running Oracle databases in a biggish cluster. Their processor power, memory capacity, and storage capacity are exactly equivalent to a Raspberry Pi 4 with a biggish SD card. We have come a long way.
- lupire 11mo ago
  That's a fancy of way of saying "not using HTTPS" which may be what average incompetent shops were doing, but isn't using HTTP everywhere which is the security standard.
jopsen 11mo ago
> TLS runs on the client and the server. There's no "TLS magic box" in between. If there was it'd be called Cloudflare :)
- ErroneousBosh 11mo ago
  Too soon :-D