Hacker News Reader

Comment by G3rn0ti | Hacker News Reader

Biggest problem with current "Zero Trust" implementations is they imply a full surveillance of employees' Internet traffic including man-in-the-middling their encrypted SSL requests. My company just deployed "ZScaler" -- a product marketed as a "zero trust" VPN solution but in actuality is an Orwellian surveillance tool. This will give "zero trust" a nice negative connotation very soon.

View on HN

Single point of failure devices for decryption of traffic (MitM) is not in line with the original definition of "zero trust", and VPNs certainly aren't either.

Zero trust arose out of this exact sort of scenario following the Snowden leaks and the NSA document showing "SSL added and removed here". End to end encryption and removing MitM middleboxes was the answer to SSL intercepting proxies.

This is a VPN/SSL interception product attempting to remain relevant by advertising as something it isn't.

ZScaler has coopted the term Zero Trust for marketing purposes. Their SSL interception tool is branded as part of their Zero Trust but is antithetical to the principles of zero trust ... in fact, IMHO anybody who deploys it is further away from achieving Zero Trust than before they started - instead of users authenticating using individually secured transactions to every TLS endpoint they connect to, it is all centralized in ZScaler which is ubiquitously trusted across the organisation. This is a centralizing of the trust model that is the opposite of the intent of Zero Trust.

I hope ZScaler gets shamed into modifying or removing some of this branding (or alternatively sued when one of their customers gets attacked or fails an audit after believing it ...)

A lot of the time, SSL MITM proxies are used as a mechanism to detect malicious content within a corporate content. I have seen, deployed across millions of machines, prevent phishing documents from being detonated thousands of times.

more like - 'zero trust' in the sense you cannot trust it

i’m not really sure what you mean. most of these products are indeed reverse-proxies, but reverse proxies do not sit in front of the whole internet, just corporate services

Reply on news.ycombinator.com