News for hackers. Stuff that matters.

A comment on TLS Termination for Network Load Balancers. Parent comment

Re:TLS Termination for Network Load Balancers by tmd83 on Thursday January 24, 2019 @08:10PM (#18994653)
What's the threat vector if it's not a cloud environment? Also if you have access to either the LB or host wouldn't you get access to the certificate there anyway to decrypt the traffic?
[ Parent | on HN ]
Re:TLS Termination for Network Load Balancers by scarface74 on Thursday January 24, 2019 @08:47PM (#18994833)
I agree. Realistically, it’s just as safe to do ssl termination at the LB. However, it’s generally interpreted that to meet certain security compliance’s like HIPAA you have to have end to end encryption and encryption at rest.

Someone posted a quoted from the HIPAA regulations where it could be interpreted as not being the case. I don’t think I would risk taking that chance though from a compliance standpoint.

[ Parent | on HN ]