Re: [TLS] TLS Proxy Server Extension

[Martin Rex <[e-mail]>]

Matt McCutchen wrote:
> 
> On Wed, 2011-07-27 at 20:17 +0200, Martin Rex wrote:
> > Only for Web-Browser scenario can I personally see a very limited
> > value that does not amount to 100% wiretapping.
> > 
> > Are you aware of rfc2804 "IETF Policy on Wiretapping"?
> > 
> >   http://tools.ietf.org/html/rfc2804
> > 
> > Standardizing MITM attacks on TLS-protected communication
> > ("lawful intercept?") seems like an extremely bad idea to me.
> 
> This is not wiretapping as defined in that policy.


I *STRONGLY* disagree.  That is very much about wiretapping and
even goes far beyond that, because it not only reveals the content
of the communication, it also allows the "TLS proxy" to arbitrarily
manipulate the communication in a fashion that might be entirely
concealed to the communication peers at the end.


I am strongly opposed to have any document describing such proxies
published as an RFC!


-Martin