On: Addressing Visibility Challenges with TLS 1.3 Within the Enterprise

[dilyevsky]

As far I understand the issue is encryped client hello.

> Can't enterprises just MITM the traffic and sign it with a CA the clients trust? What's the benefit of the previous solutions?

This wont work with cert pinning and also is a lot more expensive

[Avamander → dilyevsky]

Boo-hoo?

If it's not your endpoint then it's not yours to intercept and analyze?

[dilyevsky → Avamander]

Did you miss the part where it says “enterprise”?

[Avamander → dilyevsky]

I certainly can't see the part where saying "enterprise" should grant me the right to intercept and analyse someone's traffic.