Slashdot Mirror
Ask Slashdot: What's Your Take On HTTPS Snooping?
First time accepted submitter jez9999 writes "I recently worked for a relatively large company that imposed so-called transparent HTTPS proxying on their network. In practice, what this means is that they allow you to use HTTPS through their network, but it must be proxied through their server and their server must be trusted as a root CA. They were using the Cisco IronPort device to do this. The "transparency" seems to come from the fact that they tend to install their root CA into Internet Explorer's certificate store, so IE won't actually warn you that your HTTPS traffic may be being snooped on (nor will any other browser that uses IE's cert store, like Chrome). Is this a reasonable policy? Is it worth leaving a job over? Should it even be legal? It seems to me rather mad to go to huge effort to create a secure channel of communication for important data like online banking, transactions, and passwords, and then to just effectively hand over the keys to your employer. Or am I overreacting?"
Chances are they will whitelist any sites that may contain personally identifiable information such as banking sites etc. Most places do not want to get into privacy issues like this. Anything else is fair game. Personal e-mail might be a different story, but then again, in some verticals like finanicials, you should not be accessing personal e-mail anyway, per policy of most financial houses. Personal e-mail and the like are avenues for information to easily leave the firm.
Simple as that.
Considering that I actually do this (Internet filtering) for a living for a medium-sized company let me tell you why we do it.
Data leakage.
We're concerned about an employee either accidentally or maliciously transferring customer data or other sensitive data to an unauthorized party.
We're also acutely aware of the liabilities and sensitivities imposed by us breaking the SSL channel, inspecting the payload, and then re-encrypting it on our employees behalf, which is why we go out of the way NOT to break the chain for sites that are healthcare or financial related.
But your Gmail is fair game.
In Dutch we have a saying roughly translated to: He who distrust others, is probably untrustworthy.
Do it at home, on your own equipment like the rest of us.
The fact that you're using IE and isn't allowed to change the certificate store tells me that you don't have admin privileges. If that's case, then your company can already log your every key stroke, so I don't see how HTTPS packet inspection is any more intrusive.
I just avoid doing banking or sensitive transactions on computers that isn't administered by myself or someone that I trust.
If they don't trust you, you shouldn't trust them. If they're trying to snoop on you for whatever reason, they think you're a criminal. Would you work for the RIAA? Would you work for a boss who every time you come in he says "you're a criminal" and then proceeds to look over your shoulder all day? No and you shouldn't accept such behavior from employers.
Custom electronics and digital signage for your business: www.evcircuits.com
There are various reasons why you should not be using your employers computers for personal use. One is that you are using company resources for non-business purposes. And that is something that you don't do unless you have your boss' blessing.
I think that this may well be illegal, because even if you consent, the server at the other side of the connection hasn't consented. That means that at least one party to the communication is having their encrypted data intercepted and decrypted by a third party without their knowledge or consent. Wiretap laws apply to both communicating parties. Not aware of any case law, someone needs to actually Sue cisco bluecoat or one of the other ssl intercepting proxy makers to establish legality.
Just do your banking over your phone's carrier network. Your employer can't go there (can they?)
You can't be secure unless you control your egress. If you just let https streams go anywhere with no visibility into their content you might as well just set the firewall to allow all out bound connections. If there is ANY concern about information as an asset, you must intercept and decrypt https.
Your company more than likely has a policy that any use of their equipment is supposed to be for job related purposes, I don't think regular employees should have any expectation you are not watching everything they do on the PC provided by the company.
Usually the certificates are pushed through group policy, anyone else who shows up with their own device or other companies property will get a certificate warning, if they look at the certificate its going to show it was signed by your company. They can make an informed decision about what they want to do knowing they are being watched. So I don't see a problem there.
One thing that gets over looked with SSL intercept is YOU become responsible for the forward authentication and encryption between your proxy since the client now has no opportunity to verify the certificate itself. So you HAD BETTER BE DOING revocation checks and making sure the proxy has a sane list of trusted roots, and serve clients some kinda error page if you can't trust the certificate.
Don't quit you job. Deal with the fact that with all the spy ware and things like flame going on this is what business must do to protect themselves. Do you banking/medical correspondence/etc at home.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
You have zero expectation of privacy at work.
Since about 8 million people have said this now, I think the counterpoint needs to be stated.
You are correct, it IS their network and their rules, but that doesn't mean that it's a good idea for them to be a dick about it. I've worked for several large (over 100,000 employee) companies, and several medium sized (1000-5000) companies, and in every case, it was made clear that we were explicitly permitted to use work computers for minor or occasional personal use such as banking or email, but were expected not to abuse the privilege.
IT and programming type jobs are creative in nature. Sometimes it helps to walk away from a difficult problem for a few minutes to let your mind clear. It was always expected that you get your job done, but trying to enforce that every single moment you're sitting there you must also be working is just crazy. That's not how people are. It's much better to build an environment of mutual respect. That was understood in every job I've held.
Now, if you sit around for hours a day surfing the web, yeah, that's a problem and needs to be dealt with by your management. But if you log into some account to check your 401K for 5 minutes once a day? Getting all up in your face about that is going to be counterproductive; it'll make employees unhappy, and in being unhappy, they will be less productive and more inclined to get up in the company's face.
So you're technically right, but in any sense of wisely running a company, you're not. But of course, many companies are not run wisely...
use your phone as a local wifi hotspot
This would require me to subscribe to a plan with tethering, which is still luxury-priced in the United States market.
No, it just requires that you root your android device.
I am a geek attorney, but not your geek attorney unless you've already retained me. This is not legal advice.
So when you work for a big company, they talk a big game about being part of the team and so forth -- then turn around and treat you like a prisoner. Sure, they are within their rights, but I find it interesting that people like you are willing to defend them.
Palm trees and 8
You don't need to decrypt HTTPS sessions to find out if someone is using the internet for non work purposes.
Also I most definitely do have an expectation of privacy for any HTTPS session. If a company doesn't expressly state this in a big warning page, or at the front of their IT policy in bold then they could be open to liability. No reasonable person expects someone to do a MITM attack on you as normal business practice which could allow some pimpled intern in IT to see your banking passwords.
Who, in this day and age, has had a boss who would care about this? Hell, at some jobs, the boss will just let you cut out early for a doctors or dentist appointment without taking PTO. That's the ultimate personal business at work.
You have zero expectation of privacy at work.
The fact that people like you keep having to repeat this shows it isn't true. People do have an expectation of privacy at work, whether or not you think they should. I'm sure even you expect some level of privacy. Or do you just assume that your employer is filming you while you use the toilet?
With all due respect, data leakage is a piss-poor excuse to spy on people without their knowledge. These devices and policies work not just to snoop on SSL traffic, but to hide that fact from people browsing SSL-protected sites. I'm sorry, but that's pretty damn scummy and something that is on the level of criminal behavior.
Personally, I think that transparent SSL interception should be illegal. The transparent aspect of it means that you're not just interested in data leakage, but in surreptitiously snooping on people who realistically expect that their activities aren't being monitored. It's the technological equivalent of installing hidden cameras in the employee restrooms. (Which, incidentally, is illegal.)
Go ahead and monitor. Block if you have to. But be up front about what is going on.
I ran into this with a customer of one of my clients recently. The insurance company was using a setup from Websense to snoop on all HTTPS traffic. As best as I could tell, they were snooping ALL traffic (banking, healthcare included), not just "safe" sites.
Surely this breaks privacy laws in numerous instances. HIPAA? Banking laws? Shoot, there's a federal law that could make snooping in on your NetFlicks traffic (video rentals) illegal. Ironically, if SOPA/PIPA had passed, HTTPS snooping would have been legal.
As for the moral aspect of this, and all the people that say "you shouldn't do personal stuff at work," a few points to keep in mind. 1) Only the IT staff at this company new what was going on. No one outside the IT department could find any reference, or notification. 2) This was REQUIRED on all home PC's that utilized their VPN network (kinda shoots down doing your home stuff at home). 3) From what I was told by their IT staff (remember I was a 3rd party, trying to get our networks connections to work), the IT staff regularly "audited" HTTPS traffic. That means someone in-house was regularly looking at bank account information, and health care information of their fellow employees, and they weren't making this known to the general population within the company.
I tried to get some main stream press attention on this topic a while back. No one would bite.
There's quite a big difference between "covers most of the exits" and "completely worthless".
First off, physical security is entirely beyond the scope of the OP's problem. If you want to secure your digital assets, you are going to require both an electronic and a physical policy because data can take either shape when leaving the building. The limitations of one side really have no bearing on the other side, and if one side is your job and the other is not, don't look at how the other team is doing to determine how much effort you put into your end of the task. The goalie doesn't just not bother if his strikers aren't doing well that day. You do your job, and let them do theirs.
Second, giving up an any security just because there's a weakness somewhere isn't the answer. If you're going to consider for extreme scenarios and then throw up your hands and say "see we're not prepared for that, lets jut give up!" is entirely the wrong attitude. You're not likely to stop a CIA mole among your staff regardless of what you do, and that's not a sensible justification for completely giving up on security.
DLP is like antivirus. Only a PHB will expect 100% protection, there's going to be that 0.001% lurking around no matter how crazy you get. So you just have to decide how many 9's you need, and strike the right balance between usability and security.
And to the numerous people above complaining about accessing financial and medial records at work... what makes you think your employer is required to provide you with private access via their network while you are at work? Do this at home, duh. Same for the phone - if you're at work and pick up the company phone to talk with your doctor about your STD, do you really expect privacy on that phonecall? The internet connection there is the same way. About the only privacy you're entitled to at work is in the bathroom. It's really embarrassing that anyone makes assumptions here. Those employers are simply doing some CYA by notifying the employees of the policy (probably got your signature too) and by forcing you to use their root CA to https at work so you have zero grounds to tell a judge later that you had any expectation of privacy.
I work for the Department of Redundancy Department.
Its their network, they can make any rule they want.
Not necessarily. Doing this sort of thing can run afoul of laws in many jurisdictions, as employees often have some expectation of privacy. What they could do just fine is just block HTTPS to non-whitelisted sites from their network; that would be far simpler to implement, and wouldn't run the risk of hitting privacy laws (or employment protection laws, or any number of things that might be communicated privately).
Ultimately though, the approach in TFA smacks of a company that doesn't understand that they need to trust their users somewhat. Instead of recognizing that they need an approach that persuades their employees to keep the company's secrets, they seek to use technological means to do black-hat snooping. Trying to use a technical solution to deal with a fundamentally non-technical problem (management's failure to persuade employees to behave responsibly) is always a disaster. As it is, treating people this way encourages them to seek ways around it, and there are many creative things they could do that you've not thought of. For example, they could print the sensitive information, wrap it in plastic, and shove it up their asses; if your solution to that scenario is to immediately institute a full proctological examination of everyone leaving the company's site, you're doing it wrong. Or working in entirely the wrong industry.
"Little does he know, but there is no 'I' in 'Idiot'!"
I'd suggest you look up Man in the Middle attacks (because thats what this is)...
Your browser will /think/ it is connecting to www.securesite.com but its actually connecting to www.companyproxy.com which has issued a (fake / self generated on the fly) certificate for securesite.com and the proxy server then connects itself to the site you were originally attempting to access.
So you think its
You ==> Secure Site
but its actually
You (encrypted to) ==> Proxy ==> Secure Site.
No need for the other endpoints private key at all.
MITM attacks... Google it!
You don't own the system you are on, the company does. Their property, their rules. You should not be doing personal business at work. I hate to tell you, but they pay you to do your job not personal business.
There are two major products that come out of Berkeley: LSD and BSD. We don't believe this to be a coincidence.
We do something similar where I work. While it's theoretically possible to abuse this and snoop on personal https traffic, it's not worth the time. You are not interesting, your facebook posts are not worth an admin's time. Your personal banking information is not worth the effort to extract. Every potentially useful bit of private information that could harm you being protected by https was already given freely to the company anyway - SSN, Bank account for direct deposit, address, contact info, mother's maiden name, etc. You should be *vastly* more worried about the DBA's than the network admins. And again, you're not important enough for them to mess with it either.
Now, you should still use https at home because maybe some bigger criminal enterprises could make use of unprotected CC numbers or something (assuming they haven't already pwned your box) - but as far as your employer is concerned, there is nothing to fear from an https transparent proxy.
I totally agree because I'm embroiled in the middle of the same situation. There are still some old skool people in my workplace who haven't progressed technologically over time (and still mourn for the Windows 98 days. Yeech.) ... these are the people that cannot accept the fact that the computer on their desk is NOT theirs, that the company owns all of the data that they create. They think that nobody in the company should have access to their PC. And they don't see the harm in loading up their own software. C'mon, get real.
Actually no, since you are the one accessing it against the company policy, YOU are circumventing your copy-protection scheme and you could technically go to jail for accessing your own data.
I had a shit head boss once that actually just laid into me one morning while surrounded by 10 co-workers about being late 5 minutes to the office. Never mind the fact that I was salary and had been up supporting our china facility until 3AM.
I sat there completely stunned for a second. Walked over to him and handed him my laptop and badge and walked out the door.
Now if I was a clock puncher that is another story yes I should not be late.
Got Code?
I thought it is currently considered best practice to move ssh to some other port on any Internet connection.