Hacker News Reader

Comment by lol768 | Hacker News Reader

The MitM detection is interesting. How long until these appliances start altering the HTTP request's User-Agent header to avoid detection (or adding logic such that the handshaking process mimics that of the browser), though?

To me, HPKP with preloading seems like a more reliable approach (and browsers shouldn't allow this to be overridden [1]).

[1] If this breaks corporate MitM attacks, great. This practice always struck me as incredibly invasive and I'd personally be concerned if an employer was doing this. I think some traffic data should be able to be logged and timestamped in case of abuse (e.g. SNI info, TCP connections, DNS lookups) but I don't see a need to intercept application data - and honestly, it seems like the vast majority of these appliances hinder security.

View on HN

> How long until these appliances start altering the HTTP request's User-Agent header to avoid detection (or adding logic such that the handshaking process mimics that of the browser), though?

A TLS proxy that does this is meddling with the application layer and is thus broken (IMO). A TLS proxy that doesn't want to be detected shouldn't mess with the application layer.

The best thing a TLS proxy can do (other than be turned off) is preserve the characteristics of the original TLS connection exactly.

Indeed, Caddy's implementation is mainly for detecting TLS proxies that do a lousy job at it.

I'd also be concerned if an employer was doing it, unless there was a good reason - and I can think of a few of those. For example, companies that deal with sensitive health, financial or legal information. They may need assurances (or at least a paper trail) that's a lot stronger than "we don't MITM and we trust our employees to do the right thing".

Even with those reasons, I believe the risk outweighs the potential benefits. It's not just about trusting the intentions and assurances of the company, but also their competency and knowing they're not being compromised etc. Hackers don't care about paper trails. These are things you typically can't measure.

If you have untrustworthy employees, you have bigger problems than you can solve with by MITM attacking everyone.

I've worked at a couple financial institutions where all http/https traffic is proxied transparently (with internal key installed on corp computers)... certainly makes working with command line utils interesting... HTTP_PROXY HTTPS_PROXY are mostly friendly, but some aren't so nice.

> For example, companies that deal with sensitive health [..] information

I can understand this motivation but I'm not sure in practice the SSL interception really gives you more than the traffic metadata I already described. I think this is interesting though, so I've sent an FoI request to NHS England out of curiosity to see if they're doing anything like this.

Reply on news.ycombinator.com