<story><title>TLS 1.3 and Proxies</title><url>https://www.imperialviolet.org/2018/03/10/tls13.html</url></story><parent_chain><item><author>Spooky23</author><text>I should absolutely be able to intercept TLS traffic on my computers on my network. That&amp;#x27;s the distinction. Third party interception capability needs to be illegal and connections should be tamper evident.&lt;p&gt;Frankly, I have a higher duty than user privacy. My users have access to data that&amp;#x27;s critically sensitive in various ways, in some cases they face criminal sanction. I need to both control and detect unauthorized software on the network and ensure that users are following the rules.&lt;p&gt;More extreme privacy activists will make noises about things using endpoint based solutions or something similar. It&amp;#x27;s a bullshit position that will ultimately weaken security.</text></item><item><author>nimbius</author><text>the reason TLS1.3 has been delayed so long is vendors and researchers that believe the dual-speek that TLS needs to be both secure, as well as readily interceptable (and therefore insecure) in order for it to be &amp;quot;ready&amp;quot; to use.&lt;p&gt;TLS and encryption arent going anywhere and theyre not always going to wait around for a concensus from industry.  The sobering truth is that if not now, than in a decade or so the companies shilling TLS&amp;#x2F;SSL interception appliances and software will need to shift focus as the protocol will likely have been evolved by force over time to meet the needs of increasingly prevalent surveillance states.  TLS interception or &amp;quot;proxying&amp;quot; started out as a graduate students parlour trick and eventually evolved into an entire shady industry where players like Bluecoat are routinely caught selling their products and services to repressive regimes.&lt;p&gt;Heres hoping LibreSSL delivers the goods with or without the marketing teams say.</text></item></parent_chain><comment><author>paralelogram</author><text>The largest ISP in Kazakhstan believes that it should be able to intercept all TLS traffic on their network: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bits.blogs.nytimes.com&amp;#x2F;2015&amp;#x2F;12&amp;#x2F;03&amp;#x2F;kazakhstan-moves-to-tighten-control-of-internet-traffic&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bits.blogs.nytimes.com&amp;#x2F;2015&amp;#x2F;12&amp;#x2F;03&amp;#x2F;kazakhstan-moves-t...&lt;/a&gt;. Because there are no technical differences between your TLS interception and what Kazakhtelecom is doing and no legal differences in most non-Western countries, I believe that all software should be changed to make TLS interception as hard as possible.</text></comment>
<story><title>TLS 1.3 and Proxies</title><url>https://www.imperialviolet.org/2018/03/10/tls13.html</url></story><parent_chain><item><author>Spooky23</author><text>I should absolutely be able to intercept TLS traffic on my computers on my network. That&amp;#x27;s the distinction. Third party interception capability needs to be illegal and connections should be tamper evident.&lt;p&gt;Frankly, I have a higher duty than user privacy. My users have access to data that&amp;#x27;s critically sensitive in various ways, in some cases they face criminal sanction. I need to both control and detect unauthorized software on the network and ensure that users are following the rules.&lt;p&gt;More extreme privacy activists will make noises about things using endpoint based solutions or something similar. It&amp;#x27;s a bullshit position that will ultimately weaken security.</text></item><item><author>nimbius</author><text>the reason TLS1.3 has been delayed so long is vendors and researchers that believe the dual-speek that TLS needs to be both secure, as well as readily interceptable (and therefore insecure) in order for it to be &amp;quot;ready&amp;quot; to use.&lt;p&gt;TLS and encryption arent going anywhere and theyre not always going to wait around for a concensus from industry.  The sobering truth is that if not now, than in a decade or so the companies shilling TLS&amp;#x2F;SSL interception appliances and software will need to shift focus as the protocol will likely have been evolved by force over time to meet the needs of increasingly prevalent surveillance states.  TLS interception or &amp;quot;proxying&amp;quot; started out as a graduate students parlour trick and eventually evolved into an entire shady industry where players like Bluecoat are routinely caught selling their products and services to repressive regimes.&lt;p&gt;Heres hoping LibreSSL delivers the goods with or without the marketing teams say.</text></item></parent_chain><comment><author>kodablah</author><text>&amp;gt; I should absolutely be able to intercept TLS traffic on my computers on my network.&lt;p&gt;Just ask the users of your network to install your CA cert (or click past your cert warnings). That should work with TLS 1.3 right?&lt;p&gt;Or in your statement are you really meaning, &amp;quot;I should absolutely be able to intercept TLS traffic on my computers on my network &lt;i&gt;without them knowing about it&lt;/i&gt;&amp;quot;? If so, that&amp;#x27;s a completely different thing altogether and if that&amp;#x27;s what you and the GCHQ mean when talking about proxying, it needs to be explicitly stated. There is a huge difference.</text></comment>