Hacker News Reader

Comment by unethical_ban | Hacker News Reader

Anything that makes enterprise management of FF easier is a win for the browser environment.

That said, I'm seeing enterprise security companies selling soft forks of Chrome with all sorts of inspection and policy built in. Basically, instead of doing DLP/URL filtering/risk management on a MITM box, they're pushing it to the browser. This helps remove the need for TLS decryption, and the need to funnel their browser traffic to any particular tunnel endpoint.

I guess what I'm saying is... Firefox might want to take a look at what those companies are doing to Chrome and figure if there is a way to make it easy to plug that kind of security into their browser.

edit: just noticed this is a paid service. So I triple down on what I said. Companies that are "buying" browsers are buying browsers with deep inspection and security features baked in. I don't know if they'll buy support for FF when Edge is free.

View on HN

> Basically, instead of doing DLP/URL filtering/risk management on a MITM box, they're pushing it to the browser. This helps remove the need for TLS decryption, and the need to funnel their browser traffic to any particular tunnel endpoint.

This is where it should have been done in the first place instead of breaking TLS and creating enormous risks when that corporate MITM private key goes for a walk.

I think that these DLP/content inspection solutions should not be preferred as a first line or blanket solution because they are inherently risky and can easily be deployed wrong. Not to mention creating big privacy and security risks for users, such as when someone wants to check their bank balance from their work machine.

But in cases where there is a clear benefit when dealing with highly sensitive information, doing this inspection right in the browser is the least worst option from a security perspective when it is correctly integrated with the browser and not hacked on.

Native DLP is specifically listed as a feature FYI, also mentions compatibility with Broadcom and Trellix.

Edit: "website filtering" too

I admittedly missed that. They're still behind the curve but at least they have a good idea.

What do you specifically mean with "risk management"? Device posture?

I think we hit all the features you mention but not sure about the above.

My apologies, I didn't read far enough into the release. I thought it was more of a souped-up group policy and deployment support thing by only glancing.

I see all the things I listed are there. "Risk management" was a hand-wavey term meaning "cybersecurity stuff".

Disclaimer, I work for a competitor. Never thought I'd say that to Mozilla people! I wish you good fortune. The space is still relatively new, and not working a SME on the space, it seems there aren't a ton of competitors but some are entrenched.

I wish you good fortune.

Thank you!

Reply on news.ycombinator.com