NSA Recommends How Enterprises Can Securely Adopt Encrypted DNS

Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by XorNot on Saturday January 16, 2021 @05:42PM (#25806225)

At an enterprise level the browser configuration is controlled by the IT department. Your MITM CA certificate is going to be forced into the trusted list everywhere.

[ Parent | on HN ]

Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by kortilla on Saturday January 16, 2021 @06:06PM (#25806382)

Will that work with websites that pin cert trust anchors?

[ Parent | on HN ]

Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by vaduz on Saturday January 16, 2021 @06:29PM (#25806539)

HPKP is dead for all intents and purposes as far as browsers go. What pinning? The CA certificate store that the browser is using is something any enterprise that is interested in control is already extending by adding their own CA cert - and it has been that way for a very long time.

This approach does break some applications that pin specific certificate instead of relying on "any valid CA" model (e.g. Signal desktop) but that is seen as feature, not a bug, when it comes to enterprise.

[ Parent | on HN ]

Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by phkahler on Saturday January 16, 2021 @06:29PM (#25806541)

>> Your MITM CA certificate is going to be forced into the trusted list everywhere.

Not on my phone.

[ Parent | on HN ]

Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by pstrateman on Saturday January 16, 2021 @07:04PM (#25806751)

Then your phone doesn't go on the lan.

[ Parent | on HN ]

Re:NSA Recommends How Enterprises Can Securely Adopt Encrypt... by phkahler on Saturday January 16, 2021 @07:48PM (#25807027)

OK.

[ Parent | on HN ]