News for hackers. Stuff that matters.

A comment on HTTPS on Stack Overflow: The End of a Long Road. Parent comment

Re:HTTPS on Stack Overflow: The End of a Long Road by teraflop on Monday May 22, 2017 @04:35PM (#14396715)
Leaving aside all the reasons why this policy is super dumb (which I'm sure others will cover quite adequately), I guess your IT department can't figure out how to create their own CA certificate and do SSL interception?
[ Parent | on HN ]
Re:HTTPS on Stack Overflow: The End of a Long Road by jcrawfordor on Monday May 22, 2017 @05:32PM (#14397100)
Yeah, I'm amazed and concerned that you have a security team so paranoid that they would make SuperUser read-only but apparently lack the ability to perform SSL interception. Considering the huge value the latter has in any kind of post-compromise scenario and, increasingly, to prevent compromise in the first place... there needs to be a real discussion about getting priorities in order.
[ Parent | on HN ]
Re:HTTPS on Stack Overflow: The End of a Long Road by Spooky23 on Monday May 22, 2017 @09:22PM (#14398135)
I disagree about the dumbness.

People do incredibly stupid things. I've seen customer data dumps on web forums.

[ Parent | on HN ]
Re:HTTPS on Stack Overflow: The End of a Long Road by indexerror on Monday May 22, 2017 @05:32PM (#14397098)
Certainly doable but this should not be done.
[ Parent | on HN ]
Re:HTTPS on Stack Overflow: The End of a Long Road by BinaryIdiot on Monday May 22, 2017 @07:54PM (#14397780)
There are many enterprise "solutions" that basically do this "out of the box". Yeah it shouldn't be done and a lot of employees are likely unaware that IT can see all of their SSL traffic but it's a big business.
[ Parent | on HN ]
Re:HTTPS on Stack Overflow: The End of a Long Road by erikbye on Tuesday May 23, 2017 @05:24AM (#14399938)
HTTPS or not, certainly nothing is private here, but that's expected for this sort of place.
[ Parent | on HN ]