Re: SSL/TLS everywhere fail

On 12/04/2015 03:45 PM, Martin Thomson wrote:
> 
> On Dec 5, 2015 8:21 AM, "Alex Rousskov" wrote:
>> Unfortunately, MitM attacks on consenting participants are increasingly
>> necessary today.

> Isn't a big part of this debate over a disagreement about what is necessary?


Not in a technical sense. And we should not talk politics here.


>> No, secure communication with forward proxies is currently not supported
>> by many popular browsers. They can tunnel HTTPS through a forward HTTP
>> proxy, but they cannot be configured to encrypt their connection to the
>> forward proxy using TLS.

> Firefox definitely supports https proxies. I think that Chrome does too.

For FireFox, this is a relatively recent and partial change, not yet
available via regular configuration options AFAICT. I have not checked
Chrome. It is nice that browsers are finally adding that support, of course!


>> I have consented. I have set up an explicit proxy. The proxy plays by
>> the rules. And yet nothing works! At this point, my employer is forced
>> to attack my HTTPS traffic even though neither they nor me want to
>> resort to those dirty tricks.

> But you are not the only party that has to consent. This is a two party
> conversation, and it is very clear that the other party has not
> consented.

First of all, RFC 2804 says that my consent (as the sender of requests
and a recipient of responses) is enough to exempt this use case from the
wiretapping definition. RFC 2804 does not require mutual consent.

Secondly, the other party has not been asked. AFAIK, there is currently
no protocol that can ask the origin server for monitoring consent so the
intent of the origin server is not very clear. Just because something is
transmitted over TLS does not automatically imply that the sender
objects to monitoring of that information by a *trusted* third party. It
only implies that the sender does not want untrusted third parties to
monitor the transmission.


Alex.

Received on Saturday, 5 December 2015 00:56:31 UTC