zlacker

[return to "BlueCoat and other proxies hang up during TLS 1.3"]
1. JoshTr+w[view] [source] 2017-02-28 01:38:28
>>codero+(OP)
Note that this happens even when using a BlueCoat proxy in non-MITM mode. BlueCoat tries to "analyze" TLS connections, and rejects anything it doesn't understand. This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0.

In this case, it doesn't sound like they're reverting it because of overall breakage, but rather because it breaks the tool that would otherwise be used to control TLS 1.3 trials and other configuration. Firefox had a similar issue, where they temporarily used more conservative settings for their updater than for the browser itself, to ensure that people could always obtain updates that might improve the situation.

◧◩
2. jessau+d2[view] [source] 2017-02-28 02:02:23
>>JoshTr+w
This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1/1.0.

Good grief! From David Benjamin's final comment:

Note these issues are always bugs in the middlebox products. TLS version negotiation is backwards compatible, so a correctly-implemented TLS-terminating proxy should not require changes to work in a TLS-1.3-capable ecosystem. It can simply speak TLS 1.2 at both client <-> proxy and proxy <-> server TLS connections. That these products broke is an indication of defects in their TLS implementations.

It's understandable that I've never heard of BlueCoat: clearly this product's success is based more on selling to executives than on quality, and it has been some time since I worked in an organization that had executives to sell to.

◧◩◪
3. jacque+a3[view] [source] 2017-02-28 02:13:47
>>jessau+d2
It sounds like it might be a worthwhile effort to reverse engineer one of those.
◧◩◪◨
4. Alyssa+Xv[view] [source] 2017-02-28 08:57:50
>>jacque+a3
Reverse-engineer? A middlebox?

Which holds trusted secret keys and which, in its normal unremarkable operation, intercepts, parses, reconstructs, decrypts, re-encrypts, forwards, and optionally logs both confidential and attacker-controlled traffic? And is also known to be used for nationwide bulk internet censorship by regimes often called 'oppressive'?

Why, doesn't it just.

Please consider, very carefully, the ethics and equities issues one might face with any interesting findings here.

◧◩◪◨⬒
5. lmm+SD[view] [source] 2017-02-28 11:01:14
>>Alyssa+Xv
What's true is true - better to know it than stick our heads in the sand. If these boxes have vulnerabilities (who am I kidding, they do parsing, they're probably implemented in C "for performance", of course they have vulnerabilities), we are better off for knowing about them than not.
◧◩◪◨⬒⬓
6. Alyssa+nR[view] [source] 2017-02-28 13:49:48
>>lmm+SD
But what of the equities issue - what to do with that knowledge, once discovered? Might it depend on who "we" are?

My point is that actually helping this particular vendor, for example, may not be everyone's cup of tea.

[go to top]