Hacker News Reader

Comment by rocqua | Hacker News Reader

Interception for regulated companies. Banks have to keep a log of all communication between their employees.

That requires HTTPS interception. Before TLS1.3 they would install root CAs on all company devices, have an edge proxy, and use SNI to determine whether an HTTPS session should be man in the middled. Because it would take way to much compute to MitM all trafic (like YouTube video).

After TLS1.3 encrypted SNI blocks this. But they still need (and other companies want) to selectively intercept HTTPS. With a tool like this you can achieve that clientside, rather than at the network edge.

View on HN

TLS 1.3 and ESNI (now called Encrypted Client Hello - ECH) are separate standards, although you'll see ECH only enabled in bleeding edge stacks. In fact, ECH is still in IETF draft phase [1].

It can be disabled if an organisation wishes to. I wrote about how to do this in Chrome [2,3], and will write about Firefox when I get a chance.

[1] https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ [2] https://chasersystems.com/blog/disabling-encrypted-clienthel... [3] https://news.ycombinator.com/item?id=37823262

Ah, i didn't know they actually moved eSNI out of TLS1.3. it was certainly part of quite a few drafts.

I do find it sad it isn't pushed harder. Companies who need to do interception have legitimate concerns, but they can be addressed.

In which country is this ? In France the law is pretty clear :

> L’employeur ne peut pas mettre en place un dispositif d’écoute ou d’enregistrement permanent ou systématique, sauf texte légal (par exemple pour les services d’urgence).

And there's afaik no such legal text for banks.

Employees also have the right to privacy on their work-provided computer (e.g. to check their personal mails) so all those packet inspection and decryption things would be flat-out illegal there, thankfully

This can be tackled by excempting certain domains from decryption, which is actually part of why eSNI is a challenge for companies who do this kind of decryption on their own computers.

For regulated firms like the French one I’m at, checking personal email on work devices and the like is simply blocked.

If you want to check your private email, you can just use your personal device.

If you need to work with PII in bank, personal communication on work computer is simply prohibited.

Reply on news.ycombinator.com