Let's assume Alice is an employee of the Chuck company.

Alice likes to communicate with Bob, a server somewhere in the internet. Chuck, being a security orientated company, inspects all TLS connections from its devices by decrypting the traffic.

Is there any way for Alice to establish a secure connection to Bob with a device managed by Chuck without the chance of Chuck decrypting it?

Is there even a way for Alice to notice the TLS inspection?

As the certificates are trusted, Chuck could theoretically even spoof a VeriSign certificate, correct?

Let's assume that Chuck doesn't provide its devices with any endpoint software, keyloggers or similar and that Alice can't remove the provided cert. Let's also assume, that as in many companies ports except 443 and 80 are closed for communication.

  • You ask if the device managed by Chuck could do this. But if there is no endpoint software, why does it matter who manages the device? Do you mean if the device has Chuck's cert? – schroeder May 12 '20 at 13:06
  • Thanks for your comment. Yes, I meant a fully managed device but without any kind of logging that will inform Chuck on a layer below. So yes, the device has Chucks certificate but not an endpoint software that actively logs user interaction and traffic. – dmuensterer May 12 '20 at 13:29
  • And are you assuming that Alice cannot uninstall the cert? And are you assuming that Chuck funnels all network traffic, even non-HTTPS traffic, through an inspector? – schroeder May 12 '20 at 13:33
  • Looks like I missed some variables here. I've updated the question. – dmuensterer May 12 '20 at 13:38
  • I think your answer to the general question is "it depends". There are a lot of moving parts that may or may not exist from one org to another. – schroeder May 12 '20 at 13:40
  • Chuck Company could spoof trusted certificates if they provide their users with managed devices. But it cannot actually replicate Verisign certificates, they could just fake end-users with managed devices. Because end-users couldn't validate certificate from authorized CAs.
  • Chuck Company could hide their inspection to TLS connection from Alice TLS will be always decrypted by Chuck Company.
  • I recommend to Bob and Alice should use encrypted-communication like PGP. Just they need to find a way to change their public keys securely. It might be a social media platform like Twitter. At least one person should know others public key is not spoofed, it's assumed that controlled by Alice or Bob.

    Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications. Phil Zimmermann developed PGP in 1991.

  • Can you please name sources for your second parapraph statement? Why would Bob and Alice need to find a secure way of exchanging public keys? The whole point of public-key cryptography is the ability to exchange keys over an insecure channel. – dmuensterer May 12 '20 at 13:32
  • 1
    PGP is not PKI, and requires a secure channel – schroeder May 12 '20 at 13:41
  • Sure, I answered more theoretically if you have a managed devices or your pair has a managed device, you cannot trust what you read on that network or what he/she received from you. – myalcin81 May 12 '20 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.