HTTPS Interception Weakens TLS Security
I still find it unfortunately shallow analysis.<p>I&#x27;m currently fighting a battle in a company in the middle of rolling out Blue Coat ProxySG. I only became aware of it because it began causing interruptions to our work since none of the development tools get the necessary root cert to validate the certs that the proxy is rewriting. The root cert is only installed into the Windows credentials to make browsers work and it&#x27;s left up to every client to fix whatever other problems they have.<p>One of the common arguments I&#x27;ve encountered from people is along the lines of &quot;if the company trusts the security people, then I trust the security people&quot;. However this ignores the fact that the company has legally enforceable agreements in the form od employment contracts, NDAs, and what-have-you that protect the company against a breach of that trust.<p>But what kind of protection do you have as an individual if, for what ever reason, one of the security people decides to single you out while they have unsupervised access to you social media logins, personal email and credit cards numbers and financial details (and lets face the fact that everyone does all of these things to some degree on a work computer).<p>The answer is that you more than likely have no protection at all (likely not even in workplace law). Even if you suspected someone had inappropriately accessed your personal details, the company almost certainly has an IT policy saying that you shouldn&#x27;t be using your computer for personal use. You&#x27;re screwed.<p>However these inspection boxes drastically change the situation to what it was before, because most people outside the IT department won&#x27;t even know about this drastic change in capability. And likely they try hard not to think about until (if) they discover something has happened. I&#x27;m sure everyone here is aware of the abuses of NSA employees spying on their wifes, or ex-es [0]. Such is human nature.<p>Sadly I suspect that all these arguments will do little to change the situation. It seems more likely that the companies who deploy these systems are only going to listen to arguments specifically about how it is increasing work, causing delays of deliveries and affecting project costs.<p>[0] <a href="http:&#x2F;&#x2F;www.reuters.com&#x2F;article&#x2F;us-usa-surveillance-watchdog-idUSBRE98Q14G20130927" rel="nofollow">http:&#x2F;&#x2F;www.reuters.com&#x2F;article&#x2F;us-usa-surveillance-watchdog-...</a>