Life Is About to Get Harder for Websites Without HTTPS

Re:Life Is About to Get Harder for Websites Without HTTPS by Xcelerate on Wednesday July 12, 2017 @07:36AM (#14751639)

> If not for hostname validation, how would you even /know/ that you're talking to the "internal corporation service" rather than someones MITM proxy?

Because a crap ton of Linux software comes with its own set of bundled root CAs instead of using the system defaults. Welcome to the configuration nightmare that is setting up Anaconda, npm, AWS CLI, Python (Requests library), Git, etc. for working with something like Zscaler.

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by tgragnato on Wednesday July 12, 2017 @08:31AM (#14751915)

Zscaler performs TLS interception in order to analyse the traffic and “protect the users”. [https://support.zscaler.com/hc/en-us/articles/205059995-How-...]

The issue is that Zscaler may have flaws, and that even if the validation is performed flawlessly then the introduced risk is not zero…

Usually one would have to trust the root CAs, but with TLS interception we have to trust the trust of the MiTM software in the root CAs. This increases the attack surface instead of decreasing it.

For a security appliance it’s a pretty bad job; sure, there may be reasons why you want to look into traffic, but then the aim is to control the communication. And control doesn’t come for free.

[ Parent | on HN ]