ETS Isn't TLS and You Shouldn't Use It

Re:ETS Isn't TLS and You Shouldn't Use It by bryanlarsen on Tuesday February 26, 2019 @11:19AM (#19255546)

Banks are required by regulation to monitor & audit pretty much everything. Previously they did this for internet usage by using MITM proxies. TLS 1.3 makes that approach hard/impossible.

[ Parent | on HN ]

Re:ETS Isn't TLS and You Shouldn't Use It by snek on Tuesday February 26, 2019 @11:34AM (#19255731)

Why can't they just install their own self signed root ca on all their computers and continue MITM it?

[ Parent | on HN ]

Re:ETS Isn't TLS and You Shouldn't Use It by yfiapo on Tuesday February 26, 2019 @11:40AM (#19255794)

Certificate pinning is used by some very common applications and can break a MITM that relies on a self-signed certificate.

[ Parent | on HN ]

Re:ETS Isn't TLS and You Shouldn't Use It by JoshTriplett on Tuesday February 26, 2019 @02:10PM (#19257342)

Then those applications are correctly getting the behavior they desire: either they get a secure connection or they don't connect at all.

[ Parent | on HN ]

Re:ETS Isn't TLS and You Shouldn't Use It by Legogris on Tuesday February 26, 2019 @11:48AM (#19255911)

Do you have any example of such applications that would be used by a bank?

[ Parent | on HN ]

Re:ETS Isn't TLS and You Shouldn't Use It by yfiapo on Tuesday February 26, 2019 @12:05PM (#19256113)

I don't work for a bank so I can't speak definitively to their applications. A few sample applications I see listed as certificate pinned in Netskope (a CASB) though include:

  Adobe Creative Cloud
  Amazon Work Spaces
  Docusign
  GitHub
  Google Drive
  GoToMeeting
  iCloud
  Microsoft Office 365 Outlook.com
  Microsoft Skype for Business
  Salesforce.com

Note this typically refers to native applications and plugins which also connect over TLS and not web applications.

[ Parent | on HN ]

Re:ETS Isn't TLS and You Shouldn't Use It by Legogris on Tuesday February 26, 2019 @03:29PM (#19258044)

My suspicion was that any such applications have a web version.

I'm a bit surprised by Skype for Business (horrible product BTW, it's a gamble to even be able to sign in on a fresh install) though, the rest I would expect people to use web versions of.

I would think that (perhaps coincidentally), the organizations that require these kinds of insights are not the ones that are relying on services that do cert pinning. And if they do, they can but the marketing department/the server running THAT wonky old software from the 90s in a separate subnet.

[ Parent | on HN ]

Re:ETS Isn't TLS and You Shouldn't Use It by Dylan16807 on Tuesday February 26, 2019 @07:41PM (#19259865)

Isn't that exactly the same between TLS 1.2 and 1.3? They won't have the private keys for google drive. How are those handled today?

[ Parent | on HN ]

Re:ETS Isn't TLS and You Shouldn't Use It by goda90 on Tuesday February 26, 2019 @11:46AM (#19255892)

Are those common applications necessary for their business operations though? They could just blacklist them entirely.

[ Parent | on HN ]

Re:ETS Isn't TLS and You Shouldn't Use It by vetrom on Tuesday February 26, 2019 @12:08PM (#19256146)

besides, many of those applications depin when you install custom CAs, don't they?

[ Parent | on HN ]