Hacker News Reader

Comment by tialaramex | Hacker News Reader

> There are valid use cases for TLS middleboxes

There are, and always have been, people who are sure that they "need" to do things which don't work because the correct solution would be inconvenient for them. Those people should instead suck it up and accept the inconvenience or, as is more likely, remember they don't "need" this after all considering how inconvenient it is.

It won't suddenly work just because that would be more convenient and it's very annoying technically that we have to keep having this conversation, it's not going to stop being true just because that would make your life easier.

View on HN

Imho, clients like browsers should just indicate to the user whether their traffic can be intercepted or not (fully encrypted including client hello).

And those clients should offer an option to downgrade the TLS connection to make traffic interceptable.

You can always manipulate your client into making a connection interceptable by installing your own trusted root CA that can then do MitM. That possibility has always been there and didn't go away with TLS1.3.

It's just that many are too lazy to take control of their clients like that. Or they want to do surveillance on clients that aren't theirs to control.

Certificate pinning has made this very difficult/impossible.

We are currently failing legal compliance audits at my work due to this and are having to move cloud things (legal,financial, customer NDA'd data, etc.) back to on-premise because if it. Our cloud HR and payroll systems are really having a tough time staying compliant as the data crosses compliance domains.

Agreed, didn't think of pinning. That does of course make it very difficult.

However, compliance-wise, I'm of the opinion that anything cloud is a bad idea in general. It will just take some time for the bean-counters to realize (if ever).

> And those clients should offer an option to downgrade the TLS connection to make traffic interceptable.

They do, it's called http://

and the other option is installing a root cert, of course.

HSTS is closing this gap, too...

Well, just give up using shared hosting for services that need to be locked down. Ain’t going to happen though, because a different and at times overlapping group of people would be inconvenienced.

Reply on news.ycombinator.com