[Chapter-delegates] IETF proposing sanctioned man-in-the-middle attacks

[Elver Loho]

On Mon, Feb 24, 2014 at 12:21 PM, Peter Koch <pk at isoc.de> wrote:
> That said, end to end encryption in (or out of, respectively) corporate networks
> has been an issue ever since and the - perceived or real - conflict between
> privacy and confidentiality on one hand and the interests of corporate IT
> security on the other, has been voiced as soon as the 'encryption everywhere'
> theme gained momentum last year.

How is this an issue? Even in countries where it's legal to spy on
your employees, the corporation can install its own certificate on
each device it provides to the employee, and then decrypt/re-encrypt
with that certificate in the firewall. Such technology has been
deployed on mobile browsers for years. It's a tried and tested method.
Invoking a problem where a fully workable solution exists to justify
another solution, which would potentially open us all up to more
spying is a Bad Thing.

Best,
Elver
.ee