0000722: How to Mitigate TLS Inspection - XMB Forum Bugs

ID	Project	Category	View Status	Date Submitted	Last Update

0000722	XMB1	Research Tasks	public	2024-12-01 07:09	2024-12-01 07:25

Reporter	miqrogroove	Assigned To
Priority	normal	Severity	feature	Reproducibility	N/A
Status	new	Resolution	open

Summary	0000722: How to Mitigate TLS Inspection
Description	TLS Inspection is a potential threat to all web servers and to any client not administered by the end user. For example, the user of a computer at work or at a library might not realize the client's root trust list has been compromised. The result of a TLS Inspection deployment is that the TLS channel cannot be trusted at either end, and is effectively not confidential. This exposes passwords, session cookies, and all other data on the wire. Unfortunately, this is almost entirely beyond the control of the end user, and next to impossible to detect at the server. At the scripting level, almost nothing can be done short of redundantly implementing full asymmetric cryptography for both the client and server. At the transport level, the obvious remedy is something like Apache's `SSLVerifyClient require` directive. But this means a full PKI deployment to end users, just to protect confidentiality at the server level. It also implies end users would be tied to their own devices or risk trying to use personal certificates on foreign clients. To further complicate matters, the certificates would have to be tied to each user's account so that one user couldn't proxy traffic for another. This is a systemic risk to the whole Internet, but I am interested in any practical mitigation.
Tags	No tags attached.

MySQL Version
PHP Version
Web Server
Browser
Flags
Original Reporter
SVN Revision

Date Modified	Username	Field	Change
2024-12-01 07:09	miqrogroove	New Issue
2024-12-01 07:24	miqrogroove	Description Updated
2024-12-01 07:25	miqrogroove	Description Updated