←back to thread

Stop Breaking TLS

(www.markround.com)
170 points todsacerdoti | 2 comments | 10 Dec 25 07:06 UTC | HN request time: 0s | source
1. MathMonkeyMan ◴[10 Dec 25 08:43 UTC] No.46215494[source]▶
I remember at my first job, the internet stopped working at my workstation. I got on the phone with IT, and the guy said "looks like you don't have our new certificates." I asked why I would need my employer's certificates. He said "because we MITM every connection." I asked if that was even legal, and he said yes it's legal.

At another job I was handling a support ticket where a customer was asking, in so many words, "can I get HTTP headers of requests flowing through my Envoy TLS reverse proxy?" I said that they could terminate TLS at the proxy and redo things that way, but then that wouldn't be a TLS proxy it'd be a MITM or a gateway. They could log the downstream/upstream and duration of connections, but that wouldn't help.

replies(1): >>46232685 #
2. cxr ◴[11 Dec 25 15:36 UTC] No.46232685[source]▶
No one who understands what "MITM" means should have any expectation that I/O with a device owned and administered by a third party can be trusted (whether they do it by subverting PKI with internal certificate or not).