Hacker News Reader

Comment by prepend | Hacker News Reader

I wish this would be more broadly supported. My organization MITMs all ssl traffic on network because they deploy custom CAs to every machine.

I think this practice is harmful but there’s nothing I can do to stop.

View on HN

As long as they deploy custom CAs to every machine they own, nothing wrong with that: there are legal requirements to log or filter stuff on company computers.

Solution is simple- don’t use business machines for personal stuff[0] and there will be nothing to intercept.

[0] this is usually already mentioned in company computer use policy anyway.

You're right but in my experience the filter is often terribly implemented. I'm often blocked from completely benign websites like code libraries because they get categorized as "Pornography or Other Harmful Material". [Personal gripe more than anything]

There's nothing harmful about it. Many organizations have a legitimate need to monitor their network traffic. For example any healthcare provider has a moral and legal requirement to ensure that protected health information isn't being improperly sent outside. Traffic monitoring and deep packet inspection is also important for intrusion detection.

If you don't like it then there is something you can do: go work somewhere else, or use your own device on your own network.

It’s harmful to me because it adds costs to development and use of technology. So it increases costs for no value and reduces my bonus payout.

Moral requirements to protect patient info has absolutely nothing to do with MITM traffic to employee banking sessions, etc.

There’s very little empirical data showing benefit of this for data loss prevention or intrusion detection. What I’ve seen is security theater by companies who make money selling these products.

The other option I have, other than quitting, is to improve company policy to focus resources away from wasteful spending toward productive. As well as to try to influence browser vendors to block this. Fortunately if Chrome and Firefox go a step further and block this behavior for companies then it’s not practical for an organization to spend money to purchase a different browser. This is possible since Microsoft went to chromium.

Obviously, I can also use my own device.

Why would you even consider using someone else's device to access your private financial accounts? That's just crazy from a security standpoint. Regardless of whether the browser has a MITM certificate installed or not, the device could have other monitoring and logging software installed.

Don't use employer devices for personal business.

It’s crazy, commonly practiced, and made crazier by expensive, insecure practices like corporate MITM.

If this was a real problem, traffic should just be blocked. Not snooped.

What do you mean by "broadly supported"? Do you want browsers to make it impossible to install custom CAs?

That’s one way. I think a smarter way would be for browsers to compare the ssl cert in browser with some whitelist of ssl certs from a cdn or browser managed set and block when they differ (ie my browser is showing a different cert for HN than safari knows is valid, block it).

There’s quite a few ways to prevent this. Custom CAs are pretty necessary for internal networks so I don’t think they should be blocked whole cloth, but restricting how they can be used so they don’t impersonate real things would be nice.

Hmm, I think part of that has already been implemented by certificate transparency. But the reason it didn't block this attack is that CT is only enforced against public CAs, not custom installed CAs. The reason it's not enforced against custom CAs is that for people who do development and need to debug their own traffic, it's not feasible to have them submit to CT logs.

It sounds like you want all domains to be divided into 2 categories: testing/internal domains, and real domains. Where in real domains only public CAs with valid CT entries would be trusted, but in testing domains custom CAs are allowed. Maybe we could go even a step further in the division and disallow public CAs from testing domains. There's of course the question of how to distinguish a real donation from a testing domain; maybe this could be done by saying all testing domains must be in a special TLD such as .local or .testing .

This might work, but it it's still restricting developers, because if they need to debug some problem they have less options on how to do it. There might be a problem with cookies on the real domain that won't reproduce on the testing domain. And they need to maintain 2 server configs instead of 1, 1 for each domain.

Wow. Do you just not use local network for anything personal? What sort of business?

Finance companies do this for regulatory reasons

Worked for a publicly traded energy company that does this.

Do they also block 4G tethering?

I expect the idea is less to prevent any possible threat and is more a) to comply with regulations and b) to log enough data so if somebody does circumvent your legally required measures, they've left enough of a trail to hang themselves.

I don’t use work for anything personal. It’s directly annoying because mitm’ing calls to GitHub and other package repos causes packages to blow up a bit.

My complaint isn’t about privacy, it’s about efficiency.

Your org has every right to MITM your connections. You are on their hardware, on their line, doing work for them. You should have no expectation of privacy at work, and this includes your computer usage.

Sounds like slavery.

They have every right to do lots of annoying an inefficient practices. That doesn’t mean it’s a good idea to do so.

Reply on news.ycombinator.com