4 ms·

Is this me, or does the linked thread read like a warning about the brain damage bureaucracy can do to people? tl;dr - A company wants to be PCI compliant. -

Is this me, or does the linked thread read like a warning about the brain damage bureaucracy can do to people? tl;dr - A company wants to be PCI compliant. - PCI forbids using RC4 encoding. - YouTube now requires encryption and uses RC4 for the actual video stream (I guess for performance reasons). - Company employee thinks that opening YouTube somehow damages their PCI compliance, because the site uses RC4. - The company employee would rather have YouTube serve its site with no encryption, rather than use RC4, as somehow this would be better for their PCI compliance. What am I missing here that makes this less absurd?

saidajigumi 12y ago
The OP in that thread made it quite clear in a subsequent post: We don't have a requirement to encrypt Youtube video because Youtube videos are outside the scope of the policies we have that mandate encryption. Those policies prohibit the use of RC4 and because browsers don't allow varying the cipher support on a per-site basis, the result is nothing may use RC4. Because we don't have to encrypt the video and because Google doesn't support anything we can use we're left with the options of either finding a way to allow Youtube videos without encryption, or block Youtube on secure subnets.
- deleted 12y ago
  [deleted]
scott_karana 12y ago
It sounds more like it's a practical sysadmin stuck in an impractical pointyhead-caused hell. 1. Youtube needs to work 2. It's not considered sensitive by the business (and I hope to god nobody uses Google credentials) 3. He can't change PCI-relevant settings or he'll get fired (and the business could potentially lose some sort of financial accreditation, or endanger a business partnership) 4. He can circumvent the requirements by disabling SSL for Youtube, which seems to be a loophole in PCI's laughable "security" requirements. Sucks, but it happens. I'm sure he's polishing up his resumé.
danudey 12y ago
1. PCI compliance is a requirement for some types of business 2. PCI compliance requires that some connections are encrypted 3. PCI compliance requires that encrypted connections follow a set of guidelines, including no RC4 cipher 4. Rule #3 is not limited to encrypted connections mandated in rule #2; this allows people in the organization to assume that all encrypted connections are at least minimally 'secure', rather than 'some connections are secure but some are more secure than others'. PCI compliance doesn't care about unencrypted connections, because they mandate that sensitive data travel over encrypted connections, so unencrypted connections aren't relevant to them at all. So basically, PCI says 'no RC4 ciphers in your enterprise' (for stupid reasons) and does not allow for exceptions (for sane reasons). Google is using RC4 only (for what I assume are practical, if stupid, reasons). It's kind of surprising, since Google (or at least, large swaths of Google) must be PCI compliant considering that they do payment processing, etc.
sp332 12y ago
You would have to use a separate browser, with RC4 enabled, just to watch YouTube (and other non-secure things) and then a different browser without RC4 enabled to do everything else. And a way to prove in a PCI audit that you never use the RC4-enabled browser for anything secure.
tedunangst 12y ago
Absurdity aside, I'm rather more concerned that a computer inside the PCI fence needs to be able to view YouTube videos. With ads. Malware tainted ads.
amatheus 12y ago
Honest question, why would anyone want a youtube video stream to be encrypted?
- timothya 12y ago
  For the one of the reasons you might want the various things you look at online to be encrypted - for privacy. If the stream is encrypted, an eavesdropper can't tell which video you're watching. This might be even more important if that video is unlisted or private - an eavesdropper could watch the video that they wouldn't otherwise be able to.

saidajigumi 12y ago

The OP in that thread made it quite clear in a subsequent post: We don't have a requirement to encrypt Youtube video because Youtube videos are outside the scope of the policies we have that mandate encryption. Those policies prohibit the use of RC4 and because browsers don't allow varying the cipher support on a per-site basis, the result is nothing may use RC4. Because we don't have to encrypt the video and because Google doesn't support anything we can use we're left with the options of either finding a way to allow Youtube videos without encryption, or block Youtube on secure subnets.

deleted 12y ago
[deleted]

scott_karana 12y ago

It sounds more like it's a practical sysadmin stuck in an impractical pointyhead-caused hell. 1. Youtube needs to work 2. It's not considered sensitive by the business (and I hope to god nobody uses Google credentials) 3. He can't change PCI-relevant settings or he'll get fired (and the business could potentially lose some sort of financial accreditation, or endanger a business partnership) 4. He can circumvent the requirements by disabling SSL for Youtube, which seems to be a loophole in PCI's laughable "security" requirements. Sucks, but it happens. I'm sure he's polishing up his resumé.

danudey 12y ago

1. PCI compliance is a requirement for some types of business 2. PCI compliance requires that some connections are encrypted 3. PCI compliance requires that encrypted connections follow a set of guidelines, including no RC4 cipher 4. Rule #3 is not limited to encrypted connections mandated in rule #2; this allows people in the organization to assume that all encrypted connections are at least minimally 'secure', rather than 'some connections are secure but some are more secure than others'. PCI compliance doesn't care about unencrypted connections, because they mandate that sensitive data travel over encrypted connections, so unencrypted connections aren't relevant to them at all. So basically, PCI says 'no RC4 ciphers in your enterprise' (for stupid reasons) and does not allow for exceptions (for sane reasons). Google is using RC4 only (for what I assume are practical, if stupid, reasons). It's kind of surprising, since Google (or at least, large swaths of Google) must be PCI compliant considering that they do payment processing, etc.

sp332 12y ago

You would have to use a separate browser, with RC4 enabled, just to watch YouTube (and other non-secure things) and then a different browser without RC4 enabled to do everything else. And a way to prove in a PCI audit that you never use the RC4-enabled browser for anything secure.

tedunangst 12y ago

Absurdity aside, I'm rather more concerned that a computer inside the PCI fence needs to be able to view YouTube videos. With ads. Malware tainted ads.

amatheus 12y ago

Honest question, why would anyone want a youtube video stream to be encrypted?

timothya 12y ago
For the one of the reasons you might want the various things you look at online to be encrypted - for privacy. If the stream is encrypted, an eavesdropper can't tell which video you're watching. This might be even more important if that video is unlisted or private - an eavesdropper could watch the video that they wouldn't otherwise be able to.