TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

BlueCoat and other proxies hang up during TLS 1.3

288 pointsby coderobeabout 8 years ago

18 comments

JoshTriplettabout 8 years ago
Note that this happens even when using a BlueCoat proxy in non-MITM mode. BlueCoat tries to &quot;analyze&quot; TLS connections, and rejects anything it doesn&#x27;t understand. This exact issue occurred with TLS 1.2 back when BlueCoat only understood 1.1&#x2F;1.0.<p>In this case, it doesn&#x27;t sound like they&#x27;re reverting it because of overall breakage, but rather because it <i>breaks the tool that would otherwise be used to control TLS 1.3 trials and other configuration</i>. Firefox had a similar issue, where they temporarily used more conservative settings for their updater than for the browser itself, to ensure that people could always obtain updates that might improve the situation.
评论 #13750516 未加载
评论 #13750454 未加载
评论 #13750473 未加载
评论 #13750444 未加载
评论 #13753431 未加载
评论 #13754326 未加载
morecoffeeabout 8 years ago
Amazing how this was predicted coming on a year ago*<p>&gt; At this point it&#x27;s worth recalling the Law of the Internet: blame attaches to the last thing that changed.<p>&gt; There&#x27;s a lesson in all this: have one joint and keep it well oiled.<p>&gt; When we try to add a fourth (TLS 1.3) in the next year, we&#x27;ll have to add back the workaround, no doubt. In summary, this extensibility mechanism hasn&#x27;t worked well because it&#x27;s rarely used and that lets bugs thrive.<p>* <a href="https:&#x2F;&#x2F;www.imperialviolet.org&#x2F;2016&#x2F;05&#x2F;16&#x2F;agility.html" rel="nofollow">https:&#x2F;&#x2F;www.imperialviolet.org&#x2F;2016&#x2F;05&#x2F;16&#x2F;agility.html</a>
hannobabout 8 years ago
This is even crazier than people may think on the first look.<p>The TLS community knew that there would be problems with the deployment of TLS 1.3 with version intolerance, because there always have been. That&#x27;s why the version negotiation was changed and a mechanism called GREASE was invented to avoid just such problems. But it seems BlueCoat has shown us that there&#x27;s no way to anticipate all the breakage introduced by stupid vendors.<p>The takeaway message is this: Avoid Bluecoat products at all costs. These companies are harming the Internet and its progress.
xfsabout 8 years ago
The title was editorialized. TLS 1.3 is a working draft and Chromium is just doing field trial with it.<p>A few days ago there were other issues with this causing Chromium to stop working on *.google.com so it&#x27;s not just about middle-boxes.<p><a href="https:&#x2F;&#x2F;bugs.debian.org&#x2F;cgi-bin&#x2F;bugreport.cgi?bug=855434" rel="nofollow">https:&#x2F;&#x2F;bugs.debian.org&#x2F;cgi-bin&#x2F;bugreport.cgi?bug=855434</a><p><a href="https:&#x2F;&#x2F;bugs.chromium.org&#x2F;p&#x2F;chromium&#x2F;issues&#x2F;detail?id=693943" rel="nofollow">https:&#x2F;&#x2F;bugs.chromium.org&#x2F;p&#x2F;chromium&#x2F;issues&#x2F;detail?id=693943</a>
评论 #13753386 未加载
评论 #13750949 未加载
评论 #13751337 未加载
评论 #13751275 未加载
db48xabout 8 years ago
The long-term solution is simply not to work anywhere that insists on running a MITM attack on all of your communications.
评论 #13750633 未加载
评论 #13750650 未加载
评论 #13750636 未加载
评论 #13750629 未加载
评论 #13750559 未加载
评论 #13751256 未加载
评论 #13750853 未加载
peterkellyabout 8 years ago
From <a href="https:&#x2F;&#x2F;www.bluecoat.com&#x2F;products-and-solutions&#x2F;ssl-visibility-appliance" rel="nofollow">https:&#x2F;&#x2F;www.bluecoat.com&#x2F;products-and-solutions&#x2F;ssl-visibili...</a><p>&gt; <i>&quot;Enterprise class Blue Coat’s SSL Visibility Appliance is comprehensive, extensible solution that assures high-security encryption. While other vendors only support a handful of cipher-standards, the SSL Visibility Appliance provides timely and complete standards support, with over 70 cipher suites and key exchanges offered, and growing. Furthermore, unlike competitive offerings, this solution does not “downgrade” cryptography levels and weaken your organization’s security posture, putting it at greater risk. As the SSL&#x2F;TLS standards evolve, so will the management and enforcement capabilities of the SSL Visibility Appliance.&quot;</i>
评论 #13753282 未加载
chaz6about 8 years ago
It sounds like if you run a web server, you should think about only supporting TLS 1.3 with no downgrade support, to ensure security without the possibility of your visitors&#x27; being subject to interception by a third party (even if it is their own enterprise).
评论 #13752598 未加载
评论 #13753079 未加载
plumaabout 8 years ago
If your (content filter, monitoring, anti-virus) software is indistinguishable from malware, maybe it&#x27;s malware.
评论 #13753125 未加载
duncansabout 8 years ago
Many a head-scratching web application error investigation has resulted in an &quot;a-ha&quot; moment when you notice the `X-BlueCoat-Via` header in your logs. It does stuff like issuing GETs against URLs that only have POST handlers. It issues these random requests having procured its users&#x27; auth cookies even when the real user has since left the site.
throw2016about 8 years ago
There is a massive hypocrisy in browser vendors getting hysterical about self signed certs while letting MITM proxies operate with impunity or worse working with them.<p>Why isn&#x27;t there an effort to detect MITM proxies and post equally scary warnings? Surely users have a right to know.<p>MITM is worse than self signed certs and if &#x27;exceptions&#x27; can be found for MITM like corporate security, management etc then the same exceptions should be found for self signed certs for individuals rather than creating dependencies on CA &#x27;authorities&#x27;. This just another instance of furthering corporate interests while sacrificing individuals.
评论 #13759257 未加载
评论 #13754010 未加载
tehabeabout 8 years ago
I kinda hoped that TLS 1.3 had some magick in it so that those MITM proxies would no longer work because they can be recognized by the browser and the browser can say: how about no.<p>Also, wasn&#x27;t there some security issues relating to the possibility to downgrade the encryption of a connection?
mastaxabout 8 years ago
Wouldn&#x27;t it be better to allow enterprises to do version pinning (which I believe used to be supported in chrome enterprise), rather than remove TLS 1.3 for everyone?
评论 #13753053 未加载
shthedabout 8 years ago
I wish Chrome wouldn&#x27;t show a site as &#x27;Secure&#x27; if it can tell that the connection is being MITM&#x27;d
评论 #13755010 未加载
评论 #13754053 未加载
jessaustinabout 8 years ago
I guess in future, TLS upgrades will be opt-in?
评论 #13750635 未加载
评论 #13752098 未加载
feldabout 8 years ago
Why doesnt google have a lab of MITM proxy equipment instead of testing conformance in the wild?
dorfsmayabout 8 years ago
Browsers should add a button which allow being proxied, combined with a campaign to educate people on the difference.<p>I think its reasonable for a company to want to filter everything that comes through their pipe, if anything, it&#x27;s a bit of a liability not to do it, but at the same time, non-technical people should understand that their connection is being unencrypted and re-encrypted, and be educated on the consequences.<p>There are a few local coffee shops which terminate SSL, and when people see me closing my browser and laptop, or starting to tether through my phone because of the cert error they tell me &quot;oh, you just need to accept all those certs!&quot;.
komali2about 8 years ago
Who&#x27;s the guy with fifty thousand Chromebooks? Goodness.
评论 #13751364 未加载
评论 #13751505 未加载
评论 #13751310 未加载
评论 #13754109 未加载
dangabout 8 years ago
Edit: oops, my mistake. Carry on.<p>&gt; <i>Have some god damn ethics</i><p>Personal attacks are not allowed on HN. We ban accounts that do this, so please don&#x27;t do it.<p>We detached this subthread from <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13750650" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13750650</a> and marked it off-topic.
评论 #13752896 未加载