Re:Symantec Issues Intermediate CA Certificate for Blue Coat...
by Dylan16807 on Friday May 27, 2016 @12:21PM
(#11787019)
The objection is not to controlling TLS on a private network. The objection is to using a method that can silently intercept connections to devices you don't administrate.
If someone doesn't want to install the root cert, then "use your own network" is a perfectly fine response.
If someone is upset that the TLS security model is broken in half, then "use your own network" is not a valid response.
Re:Symantec Issues Intermediate CA Certificate for Blue Coat...
by bigiain on Saturday May 28, 2016 @02:43AM
(#11790821)
And what do I do when you get a job at my cellular provider, and decide that my internet banking or healthcare website connections might be me "exfiltrating data" and you choose to take it upon yourself to inspect the contents of those connections just in case I'm somehow "threatening the overall integrity of the cellular provider's network"?
If you provide a publicly accessible "Guest" network isolated from my corporate or private resources, that I agree that it's unreasonable to intercept TLS sessions.
If you are on my network, which exists to serve my constituents with a personal device, I have every right to or even have a duty to ensure that you aren't threatening the overall integrity of the private network. Whether that be exfiltrating data, bringing in malware, etc.
In 2016, the answer to this issue is really simple -- bring your own cellular service.