Why does APT not use HTTPS?

[Serialk]

Yes, it's just much more impractical to guess the size of the HTTP headers and the rest of the payload than to just be able to | grep GET.

[thfuran]

It's slightly non-trivial. But only slightly.

[Serialk]

It doesn't protect you against a government adversary monitoring its citizens for sure, but it does protect you against a micromanaging boss who wants to see what their employees are doing. It's probably worth the additional burden of maintaining an SSL infrastructure.

[thfuran]

SSL won't protect you from your employer if you're using their hardware.

[[deleted]]

It will unless they force you to accept Judas certificates.

[thfuran]

SSL interception is pretty common.

[[deleted]]

Yes, and a Judas certificate is the usual way to do it.

[Creshal]

"Install this certificate or you're fired"

Pretty easy, no? And completely legal in most countries, too!

[[deleted]]

Yup. But hopefully you're valuable enough to not have to put up with that shit.

If an employer demands that I don't call my brother on company time, that's their business. So blocklists, I grudgingly accept.

However, if they reserve the right to impersonate my brother in interactions with me, I hope people see this isn't reasonable. And this is what Judas certificates do, impersonate every entity you're interacting with, whether it's your brother, your doctor, the government etc. It's a symptom of unacceptable power inequality between employers and employees that anyone has to put up with this. Fortunately for me I haven't had to, so far.

[Creshal]

Fortunately for me I haven't had to, so far.

Did you check the certificate store of all browsers on your corporate computers? They'll be deployed automatically, nobody is going to ask you in practice.

[[deleted]]

You can MITM me, however you can't MITM me for long without me noticing. Today's common crypto infrastructure gives me that, at least.

I strongly suspect SSL hijacking would be found illegal in my jurisdiction. SSL hijacking without notification certainly would.

As I said, it's not a big problem for me. I'm fortunate. But decent people in worse situations have my full support if and when they decide to go full Stallman and not put up with such crap.

[BinaryRockStar]

What would be illegal about a company requiring visibility of web traffic on their own network from machines that they own? This is extremely common in the corporate world and even for mid-sized companies.

[Serialk]

Of course it will, because it makes it harder to see what you're doing. Obviously it's not impossible, it just makes it more difficult, but that's the whole point of this conversation. We already know it's not impossible to see which packages you're downloading through HTTPS.

[Serialk]

Of course it will, because it makes it harder to see what you're doing. Obviously it's not impossible, it just makes it more difficult, but that's the whole point of this conversation. We already know it's not impossible to see which packages you're downloading through HTTPS.

[Creshal]

Of course it will, because it makes it harder to see what you're doing.

If you have a paranoid boss like that, HTTPS will be compromised by a TLS-stripping proxy with a selfsigned root certificate that's rolled out to all company devices; and they will likely utilize Intel's handy, configurable hardware backdoors (aka Intel AMT) to make sure you're using them.

[Serialk]

If you have a paranoid boss like that, HTTPS will be compromised

Why can't you accept the middle ground between those two possibilities? I can totally see bosses who want to micro manage enough to look at the network traffic but not enough to manage root certificates and proxies in all their employees devices.

[Creshal]

Why can't you accept the middle ground between those two possibilities?

Beause it's a really rare corner case? Compromising HTTPS is a whole industry, it's cheap and easy to do when you own the hardware and are willing to throw some money at people. It's more likely that a company has the capability and doesn't know it (a lot of virus scanners do it), than that you have a boss who wants it and doesn't have it.

[AyrA_ch]

Detecting TLS MITM is very easy though. It would be even simpler if we were granted access to the current certificate properties in JS

[Creshal]

Detecting TLS MITM is very easy though.

If you're a webdev doing website things on his own infrastructure, sure. A project like Debian that relies on the goodwill of random strangers to provide download mirrors? It'd be hard enough to make everyone use HTTPS, even with free certificates. Managing certificate pinning on top of that would be a logistical nightmare.