Re: [saag] Ubiquitous Encryption: content filtering

On Mon, Jun 22, 2015 at 2:46 PM, Nico Williams <nico@cryptonector.com>
wrote:

> On Mon, Jun 22, 2015 at 09:24:04PM +0000, Christian Huitema wrote:
> >
> Authorized MITMing is fundamentally a part of any hierarchical
> distributed, public key authentication system when the user does not
> have full control of their user agent. We can detect it in some cases
>
when it's unwanted, but if it is "authorized" (by the "owner" of the
> device) then it's going to happen.
>
>
I'm a little confused by the quotes around both authorized and owner in
the statement above.  If a user has caused her device to use a proxy for a
specific protocol by configuration, that user has authorized that proxy's
activities.  If the user has instead initiated flows with the expectation
that they are going to the named service, rather than a proxy, then any
monkey in the middle is not authorized by the user.

Those activities are taking place to further the interests of other
parties.  For interception devices in a wireless network, those interests
might include inspection of the traffic type so that QoS may be assigned;
transcoding; content deletion; content insertion; and so on.

All the more reason to ask why we're even discussing this.
>
> > don't know which particular combination of caching, logs and third
> > party referrals we will end up standardizing, but we have to assume
> > that the security stack will eventually detect this kind of meddling,
> > and expose it. At a minimum, this is going to be a significant PR
> > issue for any telco playing that game.
>
> Maybe.  I assume many operators are doing this now, so whatever PR
> problems might result from starting to filter, they are in the past for
> many operators.
>
>
As others have mentioned, things change when you shift from intercepting
unencrypted channels to intercepting encrypted ones, as you are making a
much larger effort to impersonate the service.  That may be a difference of
degree, but it looks like a difference in kind.

regards,

Ted

> Nico
> --
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>