Hacker News Reader

Comment by cbsmith | Hacker News Reader

...and they want that for transparency, not for nefarious reasons.

MITMing TLS outside the endpoints is inherently nefarious, whether they think it is or not.

If you want to compromise the endpoint, compromise the endpoint. Install your own MITM certificates and terminate the connection in the middle, or install client-side malware. Either way, there should always be a giant warning sign on the client that end-to-end security is compromised.

They don't want to compromise the endpoint. They want to ensure they have a record of all communications to and from the endpoint.

In order to implement ETS they already have to compromise the endpoint to make the TLS 1.3 implementation use static keys, right?

Yeah, but it's a means to an end, not the end.

The assumptions that TLS 1.3 is based around are in direct conflict with the requirements of the secure environment they operate in.

This isn't some evil thing... a cryptographic protocol is a part of a trusted system, and whether it is appropriate for a particular context has to do with the design of the trusted system.

...and in this context they aren't compromising it. They're just sharing their keys so that another component, all part of the same trusted system, can also decrypt the traffic.

Sharing the key allows more than just decryption; it also allows undetectable modification of the traffic. A protocol which allowed third-party decryption but not modification would have been designed differently.

In this case the key is used by a system that is reading a log of the archived traffic. It has no direct network connectivity to the production traffic. I think we can safely say it isn't modifying the traffic... in fact, that's a requirement for the security apparatus.

Reply on news.ycombinator.com