Well, they break TLS. That's almost as broad as breaking TCP.
And it's because they want levels of control on the least affordable place. They wouldn't need to break anything if they added the supervising software to the endpoints.
And it's because they want levels of control on the least affordable place. They wouldn't need to break anything if they added the supervising software to the endpoints.
Now, I get that QUIC's developers live in a zero-trust/BeyondCorp model, and expect everyone else to too, and with COVID-19, a lot of businesses are suddenly having to look at thinking that way, it's far from how most companies work at present. And having a single box handle filtering and monitoring is actually the most affordable place to put it. ;)
The endpoints afford monitoring. The middle of the network does not afford it, so you are fighting the system and it is certain that you will break stuff.
Middleboxes are the system, and protocols that deliberately try to block inspection are fighting it and trying to break stuff.
See also RFC 7258 (https://tools.ietf.org/html/rfc7258), "Pervasive Monitoring is an Attack". Protocols that enable interception are broken and will be replaced with protocols that do not.
And they're not. Google, Amazon, Microsoft, etc. have failed to keep the Internet safe. And when they fail they hide behind liability shields like Section 230. So it falls on IT staff, more often than not, to filter, block, and intercept where Big Tech has demonstrated inability to do so.
People trying to make protocols more secure don't need to convince you, they just need to make your job as hard as possible until most users reject what you're offering.
We need a dozen more ideas like Certificate Transparency. We need pervasive end-to-end DNS security, with unencrypted DNS flagged as insecure. We need a means of preventing DNS servers from altering the DNS records of sites they aren't authoritative for. We need browsers to all agree to explicitly flag connections as insecure when they chain to a locally installed certificate, in a way that can't be hidden without rebuilding from source.
And this isn't a purely technical problem, either. We also need legal support to review regulations in certain regulated industries and demonstrate well-supported ways to fulfill those regulations without breaking security (e.g. "if you do XYZ to log the time and endpoints of connections but don't actually MITM their traffic, it's reasonably well-established that you're fulfilling ABC regulation"). We need lobbyists to change regulations incompatible with secure protocols. We need designers to make security as usable as possible, because poor usability is a security problem.
(This is assuming they aren't using pinned certs baked into their firmware, anyhow. I don't have good data on which manufacturers/devices are doing this, but somebody else might know.)
If you want to run those devices in production, put them in a separate network or VLAN where they can't see anything they don't need to see.
As it is, don't Chromecasts refuse to function if they can't reach 8.8.8.8? Add encrypted DNS to prevent inspection and transparency, and people are being asked to have potentially hostile devices in their network with no way to inspect them.
(And the PKI infrastructure is the best thing we have; I'd certainly like to see it replaced with something even better.)
So creating a system where I, as a consumer, have no way to inspect the communication my devices undertake removes my rights and safety in deference to companies that really just want to make it harder to block ads.
I take issue with this entire model. The fact that PKI has had piles of issues with bad actors who are supposedly supposed to be bastions of trust doesn't give any example this is a system we should trust, much less have browsers force people to utilize and scare people off avoiding.