Hi Everyone, Citrix NetScaler Gateway: Logon Encryption Need your opinion! What do you think about this optional functionality being enabled by default in one of the next builds?

Following. I see it recommended in the secure deployment guide, but I've also been curious about it.

What is Logon Encryption for? The answer is that TLS protects the wire, not the browser. The password exists in plaintext on the client long before it reaches the wire, and it lives there in several uncomfortable places: • In the DOM and in JavaScript memory, where any browser extension with content-script access can read it. • In endpoint memory, where infostealer malware scrapes form fields and browser processes. • In any TLS-terminating middlebox on the path. Corporate SSL inspection proxies decrypt, inspect, and re-encrypt. For the few milliseconds the proxy holds the request, your user's password is sitting in plaintext inside a device you may not fully control, and sometimes inside that device's logs. Logon Encryption closes exactly this gap. NetScaler delivers an RSA public key to the login page, the browser encrypts the credential fields client-side before the POST leaves, and only the appliance's private key can decrypt them. A TLS-inspecting proxy now sees ciphertext where the password used to be. A malicious extension reading the form sees ciphertext. The password is protected from the moment it is typed until it reaches the box, not just from the moment it hits the network.

Sounds interesting, we were looking at rolling out App Protection after Client App Management is in place for keylogger prevention type stuff, seems like this would compliment it well.

Curious what issues we might see from enabling it

IMG_8234.jpg

linkedin.com/pulse/citrix-gateways-logon-encryption-artur-ogloza… Found this: 4. Notes on Behavior • If the browser does not support the required JavaScript, or if a custom login theme is missing the encryption scripts, login will fail with errors like cannot decrypt password. • This feature is not enabled by default and must be explicitly activated in the configuration.

Is there an announcement somewhere about it becoming the default? Thanks for all this

Was just about to ask, excellent timing! I second the above, ha.

There are currently no plans for this to become a default feature, but I've already pitched the idea to Citrix. Now I'm just gathering your feedback to share with them 😉

It looks interesting, I would need to test as we use a custom theme, it's basic enough. Hopefully not a bad surprise. I don't think it should be enabled by default except for new deployment if there is any risk to break things or give enough notice about it.