Does your employer have a right and obligation to see that you're searching for a cancer doctor?
Go to a large company's IT department and find the person there you dislike the most. Do you want that person monitoring the traffic and seeing that you searched for a cancer doctor?
Now you know why so very many of us believe you are completely wrong about this.
Do you have the right to prioritize your personal activities over your employers protection of its' data?
Creating blindspots on enterprise networks won't get far - especially not given today's realities of breaches.
It is absolutely fine in many countries to use a work computer for light and occasional personal use or on breaks. And no, employers don't always have the right to monitor all traffic that isn't relevant to the business, or even files on your machine marked as personal. Really depends on the local laws though.
Now you see why so many of us believe you are completely wrong about this.
To your point:
If it is their network, it's their network and their computer. Access the website from home, or from your phone, which isn't MITM'ed on the corporate network.
If it is a resource only available on the corporate network, but it is not a "company resource" such as find-a-doctor, then you can (a) accept that the company may see it, (b) contact information security and ask if they can, or (c) find another way to get the information/complain to HR/ombudsman/whatever.
It is up to the company to do the right thing when possible, which means (in our case) we don't intercept websites categorized banking, health, and a handful of others.
Information security obfuscates/blocks the showing of personally identifiable logs to the rest of IT, as well.
Again, banks (in my example) have an obligation to their millions of customers to protect their data, more than you have a right to browse a doctor tool or upload sensitive spreadsheets to your personal Google Drive to work on over the weekend.
I don't have to provide a "proposed solution" to MITM; the proposed solution is "stop that". To the extent MITM is getting harder, that means network protocols and software is getting better.
This is like asking the makers of adblockers what their "proposed solution" is for ads, or asking the makers of spam filters what their "proposed solution" is for sending spam.
Most critically, in a standards body, the right answer to people trying to MITM is a polite and diplomatic version of "go away, your use case is invalid".
> If you do not think private companies and businesses have a right, and sometimes an obligation, to secure and monitor the traffic on their networks
They can certainly try (currently), and one of the jobs of security researchers is to ensure they fail enough that they stop trying. I also hope one day that there's enough collective bargaining power among engineers that such companies cannot successfully hire people, and that nobody ever has to be desperate enough to accept such a draconian network. I'm glad I'm in a position to be able to say I'll never work for a company that requires MITM; everyone should be able to avoid that. And the only time I'm aware of a company having an obligation is due to misguided regulations on certain narrow classes of businesses.
> MITM technologies are a societal risk more than a benefit
The company is the only one who could possibly benefit, and that's leaving aside the likely possibility of doing more harm than good; security measures work better when your users want to help you rather than thwart you. Meanwhile, the societal harm of ever allowing MITM is massive.
Right now, the biggest step I'd love to see happen is browsers (in concert) having a persistent banner for "your traffic is being MITMed" any time they're getting the wrong certificate for sites, and browsers making that impossible to remove without rebuilding the browser from source (which is a substantial barrier). Next, we can make it easy for sites to detect access from MITMed networks, and make policy decisions on that basis. Then, coalitions of sites can collectively make it expensive to MITM.
Put that together with new protocols that are increasingly desirable, and increasingly unavoidable, and which users will want, and you have a recipe for substantially reducing the number of companies willing to even try to MITM.
> then say "You can block spam and outbound attacks without MITMing traffic."
"We block outbound email ports" is not an unreasonable policy, as an example. And if someone tunnels around that, now they're spamming from their network, not yours, so it's not your fault.
> How do you propose DLP gets accomplished with zero access to the network?
"DLP" has become equated with "MITM". But you could, instead, focus on access to the data rather than interception of exfiltration. If people are trying to exfiltrate your data, they will find a way, very very easily. And there are much better ways to catch accidents. Also, most companies are still at the level of avoiding headlines like "laptop stolen with our whole database on it", which has nothing to do with MITM.
No, my experience says you do.
The enterprise needs to prevent data breaches and data exfiltration. If you want them to move away from MITMing, then I believe you would fare better if you provided an alternative solution.
Further, unless you have some voodoo magic, preventing breaches and exfil, would still require inspecting something - whether it's at the OS, client, or data level. IOW: you are simply moving the inspection around from network to somewhere else - but it's still inspection - and invasion of the employee activities.
Yes, access to sensitive data is one layer of defense in depth for data exfil - absolutely on point there. But then you throw up your hands and say "oh well" if they do get data, or if they have legitimate need to see it, and try to get it out. I don't buy that.
I agree with some of your thoughts in principle: Just like I don't agree with backdoors in crypto, I applaud TLS getting stronger toward PFS and eliminating MITM. But you're naive if you think companies don't have a right or desire to monitor the systems that hold their intellectual property, and their customers' personal data.
Your bio says you work at Intel. I'd bet a month's rent that there is a MITM proxy on your corporate network.
On the contrary. I think it's critical for businesses to protect customer data. Many customer data breaches are "someone left the S3 bucket open" or "someone had the database on an unencrypted laptop in their car" or "someone broke into the production database using a security hole we failed to patch". How many customer data breaches are "one of our employees intentionally leaked the customer database"?
The sign of a good security policy is that your employees are actively trying to help you. The sign of a bad "security" policy is pervasive word-of-mouth knowledge on how to bypass that "security" policy to get work done. Which network is more likely to experience a breach?
(I should also clarify that there's a difference between "policies for the corporate network" and "policies for direct access to the production datacenter network", as one of many examples. Lock that down to the point that you can't easily access it, and nobody can do so without oversight.)
> if you think companies don't have a right or desire to monitor the systems
Companies have a right and a desire to run ads, and yet adblockers exist, and generally speaking the adblockers win for anyone who installs one.
I see this isn't going anywhere - you didn't acknowledge that if you work at Intel, you 100% have a web proxy on your campus despite saying otherwise, and now you're comparing adblocking by a private user on their computer on their time, and someone accessing the internet from their company's network on their company's time when and uploading arbitrary data across the Internet.
Again, you make some good points interlaced with bad ones: Yes, limit desktop access to corporate servers. Have strong IAM and auditing. But you think there is some right to have all the privacy in the world on their machine on their time. I fundamentally disagree.
And would you, or whoever is doing it, stop downvoting me? Despite our disagreements, this has been a substantive argument.
> And would you, or whoever is doing it, stop downvoting me?
1) You can't downvote people who reply to you. 2) Discussions about downvotes are off-topic. 3) Downvoting to express disagreement is explicitly allowed.
Let me be clear: If you do not think private companies and businesses have a right, and sometimes an obligation, to secure and monitor the traffic on their networks, then you are flat out incorrect, and this conversation can end.
If you agree they need to monitor data, but that MITM technologies are a societal risk more than a benefit, I am all ears. Host-based data scanning at an OS level; signed traffic that the network can trust has been scanned by authorized hosts (so rogue hosts don't send traffic out); and so on.
edit: I don't think your message is consistent, but I think that is not a sign of malice. You say "Companies have no legal or moral need to see what content is leaving their network" then say "You can block spam and outbound attacks without MITMing traffic."
You seem to be equating "See the content leaving their network" with "MITM", but then say later that companies can "prevent outbound attacks" without MITM. The #1 threat for many companies is data loss. How do you propose DLP gets accomplished with zero access to the network?