logoalt Hacker News

NicolaiSlast Wednesday at 11:50 AM1 replyview on HN

TLS inspection can _never_ be implemented in a good way, you will always have cases where it breaks something and most commonly you will see very bad implementations that break most tools (e.g. it is very hard to trust a new CA because each of OS/browser/java/python/... will have their own CA store)

This means devs/users will skip TLS verification ("just make it work") making for a dangerous precedent. Companies want to protect their data? Well, just protect it! Least privilege, data minimization, etc is all good strategies for avoiding data leaking


Replies

tptacekyesterday at 2:02 AM

Sure it can; it just requires endpoint cooperation, which is a realistic expectation for most corporate IT shops.

show 1 reply