Hacker News Reader

Comment by pilif | Hacker News Reader

>also force me to install certs on everything I own before I can comfortably let those things on the network

I'm curious: How is TLS 1.3 different from TLS 1.2 in that regard? How would you implement an intercepting proxy with TLS 1.2 and without installing a CA cert in the clients?

View on HN

I guess the encrypted SNI draft is what's meant here.

Thanks, sorry, you are totally right and I should be more specific.

Yes. It’s a metadata leak and generally I am pro the end-to-end principle but encrypted SNI actually forces everyone to MITM. Whether that is good or bad is a value judgement but for people who have been doing “light touch” egress filtering it is a huge PITA. It is actually going to force more invasive surveillance in basically any regulated workplace.

Personally, I think it's a good thing it forces MITM. Either you monitor your users browsing habits or you don't. If you do, it's only fair if they have a chance to know that you do and seeing an SSL connection be "protected" by a company-internal cert makes that totally clear.

The thing is, most users won't look for that. I like what Android does, where if you switch on a VPN or install an extra CA, you get a "your network use may be being monitored". That should appear in the browser.

How could you rely on SNI for filtering? How did you know they weren't just domain fronting? Or was it about blocking access to regular sites?

Reply on news.ycombinator.com