I also don't think you have a right to present to a user a certificate for a domain/company/individual you're not actually authorized to represent. IOW I think all MITM certificates are acts of fraud, and should be prosecuted as such.
-
-
-
Replying to @SwiftOnSecurity @taviso and
That doesn't make it any less fraudulent. You could sign a release saying you don't care if I forge other people's signatures on checks I give you, but it's still fraud for me to forge those people's signatures.
1 reply 0 retweets 0 likes -
-
Replying to @taviso @RichFelker and
I concur. Would that real privacy could exist even at work, but that's not life and there are employers who only reluctantly deploy this stuff because they're legally required to. I'm not debating validity of corporate MITM. It's valid and needed.
1 reply 0 retweets 0 likes -
Replying to @mdhardeman @taviso and
Where I think there's room for improvement is that I don't believe there's any good reason for any of Chrome's product decisions to be based on not inconveniencing that segment.
1 reply 0 retweets 1 like -
Replying to @mdhardeman @RichFelker and
Where did you get this "invoncenicing" from? The problem is we don't want them in our address space, because they will get it wrong and make things worse and less discoverable for users! Explain how a user finds out if chrome.exe is being hooked, is that easier or harder than CA?
1 reply 0 retweets 0 likes -
Replying to @taviso @mdhardeman and
Do you think you can safely inject a DLL and hook chrome? I don't think you can, it's really hard. I think you probably can set up a corporate CA. I don't think you should, but if I have to pick one - I pick the latter.
1 reply 0 retweets 0 likes -
Replying to @taviso @RichFelker and
Concur. But where I think this hypothetical hook comes into play is when Bluecoat customers can't log in using a WebAuthn token because of the MITM + a token binding requirement for the auth from the server side.
1 reply 0 retweets 0 likes -
Replying to @mdhardeman @taviso and
My belief is that this shouldn't discourage token binding or similar anti MITM techniques which offer realistic security benefit just because they may make the MITM vendors desperate. Just ensure that forking their own browser is easier for them than patching yours.
2 replies 0 retweets 0 likes
That's the problem, Token Binding *doesn't* offer any security benefit *and* we think it will force people to start hooking. If there was a huge security win here, who wouldn't take that deal?
-
-
Replying to @taviso @RichFelker and
U2F can utilize token binding to ensure that the two TLS endpoints speaking to each other are the parties to the authentication process. Presently, this is a gap in U2F coverage and a party today could actually MITM a U2F authentication.
1 reply 0 retweets 0 likes -
Replying to @mdhardeman @RichFelker and
Arghh! No, it can't. Token Binding *can* (depending on implementation) make sure that you're talking to the machine you're think you are, but it can't promise that machine isn't compromised. There is no attack that TB prevents, it just changes how you exploit it.
1 reply 0 retweets 0 likes - 9 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
