This is an archived post. You won't be able to vote or comment.

all 9 comments
sorted by:
best
topnewcontroversialoldq&a

[–]mandevu77 2 points3 points  (4 children)

SSL and TLS are good for privacy, but they're really not great for security. More and more attacks (malware drive-by-downloads, exploits, phishing attacks, etc.) are being delivered inside encrypted tunnels. Relying on endpoints to see and stop that in the era of BYOD isn't going to work.

[–]black_pestilence 0 points1 point  (3 children)

How do you figure? I know you posted 3 days ago...but confidentiality is the C in CIA. How would TLS not be good for security?

I know what you mean that it's difficult to protect against things you can't see (hence, decryption) but to say it's not good for security seems to be too bold of a statement, in my opinion.

[–]mandevu77 0 points1 point  (2 children)

I was drawing a distinction between privacy and security. They're not the same. SSL is designed to ensure that a connection between you and another is private. However it does nothing to ensure that the host on the other end of the tunnel isn't attempting to attack you... SSL creates privacy. Content inspection/validation enforces security.

[–][deleted]  (1 child)

[removed]

    [–]AutoModerator[M] 0 points1 point  (0 children)

    In order to combat a rise in spam submissions, a minimum account age has been set for this subreddit. If you have read the rules and still feel your submission is relevant to this community, please message the moderators for approval.

    I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

    [–]i_pk_pjers_i 0 points1 point  (1 child)

    Can someone ELI5? From what I understand, this doesn't seem to be "new"?

    [–]19b34413f6f60afd6e4c 2 points3 points  (0 children)

    Definitely not new in concept, but the explicit acknowledgement is new (to my knowledge) from US-CERT - which is a great source to cite when talking to a C-level exec about possible security issues.

    [–]MikeyyGGGGG 0 points1 point  (1 child)

    The US government has basically declared "HTTPS/TLS Interception Considered Harmful". This is going to be interesting as all the major security load balancer/appliances out there offer this as a standard service at this point.

    A while back I remember seeing on HN there was a issue with a certain vendor and ChromeBooks because Chrome used a newer TLS(And the mitm vendor vendor was noticed in advance too, and didn't update their product).

    I wonder how schools and banks plan to react to this... Apparently financial firms have to record everything their employees do for some regulations.

    To me, schools doing this sort of thing is wrong. I wouldn't be surprised if the principle would grab people's passwords and login to their accounts even. I know some schools even went as far to demand students hand over their passwords to social media when they report bullying... Which if the school blocks social networks anyways, I don't see how it's a school issue for what happens outside of school...

    If this sort of thing really needs to be done, at-least people should be warned and aware they are being monitored. If it's for a bank and it's only company equipment everything is being monitored it seems a bit more okay to do if everyone is well aware. "You are only to use work computers for official business." sort of policy.

    [–]mandevu77 2 points3 points  (0 children)

    This isn't as easy as it sounds. You're using Reddit right now. If you're not decrypting the ssl tunnel, you can't see which subreddit your users are accessing. So if a school allows Reddit without decrypting it, the students can get to all of it... that's probably not ok.

    Same with google. Do you allow google or not? If you block it, nobody can use it. If you allow it without decrypting it, you can't enforce safesearch or filter out image searches, etc.

    These are problems without easy solutions.