Hacker News Reader

Comment by josephcsible | Hacker News Reader

> while ECH provides a significant privacy improvement, I personally am against its implementation. Most ISPs enforce country-specific orders to block domains using a combination of DNS packet interception and SNI inspection. The legitimacy or sanity of such laws are a separate matter - countries would want to block websites that violate their laws.

That's exactly why I'm in favor of it: it makes effective censorship impossible.

> If we take away this last resort from governments, they would react by enforcing client side blocklisting and DRMization as suggested in France[2], or force root certificate installation using legislation[3]

Note that those plans both thankfully failed.

> or blocking large swathes of the internet as is the case with China.

No free country would tolerate that.

View on HN

> No free country would tolerate tha

Which countries do you have in mind?

I know a lot of Americans talk that way about America, but America tolerates quite a bit of government censorship (DMCA/SLAP), privacy violations (NSA/TSA), and civil rights violations (prison slaves, war on drugs).

> No free country would tolerate that.

Most of Europe will.

We will almost certainly block ECH at my work, as we already block DoH. I expect any sane network to do the same.

The natural alternative if blocking these protocols becomes unsustainable will absolutely be to require full decryption at our security edge. And that will provide drastically more information to us than we have now and will absolutely feel invasive.

The idea of uninspectable client traffic is somewhat unhinged, and is already heavily used by malicious actors.

> I expect any sane network to do the same.

Why? Sane networks shouldn't block anything. Even super dangerous stuff like ports 135-139 and 445 are a morally gray area.

> The idea of uninspectable client traffic is somewhat unhinged, and is already heavily used by malicious actors.

How is privacy unhinged? Isn't that basically the same as the argument that we need to gut the Fourth Amendment because of terrorists and pedophiles?

I don’t think morals factor in to the decision to allow / disallow traffic on a private network. That’s definitely morally neutral and to suggest otherwise is immoral.

I didn't mean private networks. I meant the ISPs that do that.

ISPs are also private networks, unless operated by a government entity. And I would absolutely uphold the same expectation from an ISP as an organizational or personal network.

> And I would absolutely uphold the same expectation from an ISP as an organizational or personal network.

No. ISPs provide internet service to customers who pay them for it. The entire situation is different. The ISPs are under no obligation to break and inspect encrypted traffic. Owners and operators of home and corporate networks have an entirely different(and justifiable) set of concerns.

> Why? Sane networks shouldn't block anything.

Huh? What? Ever had to administer a corporate network for non-tech staff? Malware is everywhere. People are stupid. AND my assumption on a corporate network has always been that you have no expectation of privacy - its a work network, don't use it for personal stuff! Pretty simple.

If it's really a corporate network, then the company will own the endpoints and can do the inspection there.

Not meaningfully so with ECH, the whole point of this subthread.

Corporate networks often use MITM master certs that employee browsers must accept.

ECH only makes network-level monitoring harder. Monitoring on the endpoint is still just as easy.

> my assumption on a corporate network has always been that you have no expectation of privacy

That certainly isn’t true in the EU. You cannot spy on employees computers without a cause.

"Malicious actors" are employees trying to visit instagram from work, right?

No. https://www.bleepingcomputer.com/news/security/hackers-incre...

The problem is that what starts as a strong desire to conduct copyright infringement (or sure, some light personal web browsing on work computers) along with a dash of free speech extremism, has turned into a militant expectation of very handy passageways for actual crimes.

I think they mean malware. Ransomware for example. Nothing wrong about locking a network down in general. Work network doesn’t have to be an open, all things go, network just so employees can instagram. Heck, there are organizations with air-gaped networks for very good reasons.

Instagram on your phone while at work. Don’t expect privacy on managed work machines. You company can see your emails. They can install CA on your managed machine and MITM your https traffic.

I hate the trend of also managing personal devices. But I get that it’s a complicated subject.

I'll be worried when I hear the first case of an employee getting in trouble for doing something innocent on corpnet. Right now I assume they can see everything while using one of their devices or on their network but they never bug us about it. They seem mostly interested in stopping malware/leaks, which seems quite reasonable.

As the grandparent of this thread, I can definitely say I don't care about personal browsing on work computers. I consider that an HR issue (if it impacts their ability to do their job), not an IT issue. The ability to manage network traffic comes entirely from maintaining a secure and functional network.

MITM can't prevent leakage for a determined spy or insider trader. I worked at a bank, they blocked FB etc with a blacklist, but it was very easy to circumvent. Whitelist might work, but it would create too much management headache.

Reply on news.ycombinator.com