Husband, Father, IT Pro, Air Force.

I ask a lot of challenging questions, don’t assume that’s what I believe or endorse.

  • 4 Posts
  • 53 Comments
Joined 11 months ago
cake
Cake day: December 12th, 2023

help-circle















  • The analogy of the fire department was a good one. Also a very good point about door locks.

    I have similar thoughts about the electronic security alarm in my house when I hear the rare security vendor employee insider threat that broke into someone’s house by turning off the alarm. I still have one though. Like you said, I just chose to mostly trust them based on the hope they’ll internally police themselves out of their self interests to keep a good reputation and make money.

    I do wish legislation could force vendors to be very transparent with their privileged access instead of the consumer or user just assuming it. Like a surgeon generals warning, “we made this, so we can unlock it. We are also forced by law to tell you when we’ve done it”. This of course is unrealistic from a national security or investigation standpoint.

    Also good points about trust. We have to trust an enormous amount of institutions like banks, public service agencies, etc. Americans are having trust issues with law enforcement as a result of too many issues or abuse.

    I wonder how many people care more about the secrets in their phone than their bank account?

    I also don’t live in a country where I can reasonably expect the government to spy on me and take my freedom just for criticism, so I guess the stakes aren’t as high. The airdrop cracking in China comes to mind. Plenty of countries are being accused of using spyware against journalists and opponents.




  • I setup our transparent proxy so we can do interception and IPS. I’m interested/concerned about the ability to use an intermediate ca cert downstream inline somewhere (like a teoco) and if regular consumer desktops would alert on that since their browser would trust the root. We GPO place our intermediate cert in the Windows trusted intermediates. I can’t remember if browsing breaks without doing that.

    Not really a concern if there’s other certs/TLS required.in addition to the QWACs cert thought.

    I got the impression the easier threat/worry was compromise of a nation CA and issuing illicit duplicate site certs, to then spoof a bank site. Still requires traffic redirection with DNS or routing though I think.