3 ms·
Some organizations have IT security departments that attempt to foil encryption already. They use devices to terminate SSL before it leaves their network and fo
by 16s 13y ago
Some organizations have IT security departments that attempt to foil encryption already. They use devices to terminate SSL before it leaves their network and forge certs back to clients and basically act as a MITM for the clients making the TLS/SSL request. They do this to inspect the traffic before it leaves the network.
I predict that in the next 5 to 10 years, many organizations across all industry sectors will drop/reject encrypted packets (SSL, SSH, SFTP, etc) that they cannot decrypt. And the reason they'll give is that it makes them more secure.
The concern I have (as a security technologist) is that most people who use encryption are not bad, however everyone is punished and every packet must now be inspected because a few people use encryption to do bad things. So one day soon, I'm afraid that anyone who uses encryption will be suspect simply because they do and the stronger the encryption, then the more suspect they'll be.
Will it become illegal to do encryption research or use OpenPGP unless you agree to escrow your private key or will everyone be forced to use very weak ciphers? In today's climate (encryption is evil), I see all of these things as very real possibilities.
- wiml 13y agoCisco firewalls, by default, perform a MITM protocol downgrade attack on the SMTP sessions they see. They modify the SMTP setup to prevent the endpoints from negotiating STARTTLS and cause them to fall back to cleartext communication. Has been true for years. You can turn it off... but how many admins do? If you want an example of behavior which is completely plausibly-deniable, but which immensely reduces internet security, this is a good one.