News for hackers. Stuff that matters.

A comment on Working Group Last Call: QUIC protocol drafts. Parent comment

Re:Working Group Last Call: QUIC protocol drafts by JoshTriplett on Wednesday June 10, 2020 @08:10PM (#23483692)
> Then simply do not add a CA or self-signed cert to your cert store. IOW: the default is secure against SSL MITM. Nothing to "get used to" or "abused".

Once upon a time, there were public CAs who would sell you a sub-CA certificate for use on a hardware MITM box, so that you could "transparently" MITM systems on a network without adding a CA. That is now considered unacceptable, and grounds for terminating a CA. What "security" practices in use today will we be saying "once upon a time" about years from now?

[ Parent | on HN ]
Re:Working Group Last Call: QUIC protocol drafts by droitbutch on Wednesday June 10, 2020 @09:46PM (#23484435)
> What "security" practices in use today will we be saying "once upon a time" about years from now?

Can an industry not mature?

Previous behavior is not an indicator of the future - and anyone worried about it can contribute to scrutinizing CA's and their guidelines today.

Not sure pre-judging current actors based on past actions during a relative nascent industry gets us anywhere - especially since you still haven't provided an alternative solution for enterprises to prevent data breaches or data exfiltration WITHOUT inspection happening somewhere else other than the egress chokepoint.

[ Parent | on HN ]