"Everything is TLS now" - what is a first-hop position on a flat office VLAN still worth?

## The claim, stated fairly "Everything is TLS now, so an on-path position buys nothing" is not stupid. It is half right, and the half it gets right is the half people find easiest to remember: the content of an encrypted session is not readable by a machine sitting between the endpoints. Take that as given here. The mistake is the inference - that a position which cannot read a session is therefore worthless - because it treats the network as nothing but a pipe for sessions that already exist and already know where they are going. A first hop is not in the session. It is underneath it, and it acts before the session exists. ## Choosing the destination before there is a session The most valuable lever depends on which route to the position was taken. An attacker installed as the host's resolver, by answering its configuration request, decides what names mean for that host. Where a name points, whether it points anywhere at all, and how long the host caches the answer are now the attacker's choices. That is upstream of every protection a session applies to itself, because it determines which endpoint the session is opened to in the first place. It is also selective: one name can be answered differently while everything else behaves normally, so the host's experience is entirely ordinary except in the one place that matters. An attacker who instead took the position by answering for the gateway's hardware address holds the path rather than the resolver, and has to interfere with lookups in flight to get the same lever - more work, and a good reason the two routes are not priced the same. ## Denying the upgrade Not everything on an office segment starts encrypted. A range of protocols open in the clear and negotiate an upgrade afterwards, and a great deal of fixed-function equipment offers a plaintext service alongside a protected one. A first hop can decline to let the upgrade happen - by dropping the step, by answering as though the capability is absent, or by making the protected path fail while the plaintext one works. The client then does what clients do: it falls back, or it retries, or it fails in a way a user resolves by choosing the option that works. The position does not have to break encryption if it can arrange for encryption never to be negotiated. ## Dropping is a capability, not a failure A machine that every packet passes through can discard packets, and discarding is deniable in a way that reading is not. A segment that occasionally loses traffic looks like a bad cable. Selective dropping gives the attacker three useful things: denial of a specific service for a specific host; the ability to make a preferred path fail so a worse one is chosen; and time, because a host that cannot reach one destination usually tries another. None of this requires seeing a single byte of anything. ## The segment is not only laptops The strongest counter to "everything is TLS now" is to look at what is actually plugged into a flat office VLAN. A conference-room segment commonly carries printers, badge readers, IP cameras, room controllers and similar fixed-function devices. Those devices largely do not encrypt what they send, frequently authenticate nothing at either end, and are managed - if at all - by whoever installed them. The laptops' encryption is irrelevant to a print job, a door event or a camera stream sharing the same broadcast domain. Any assessment that reasons about the segment as though it were a fleet of modern browsers has assessed the wrong half of the segment. ## Pattern, timing and volume Even for the fully protected sessions, the position observes that they occurred: which destinations a host reaches, when, how often, and how much moves. That is not content, and it should never be described as though it were, but it is a real product of the position - enough to know when a machine is in use, what it habitually talks to, and when that changes. ## How to answer the reviewer The crisp version, and the one to say out loud: encryption protects the **content** of sessions it covers; the first hop controls whether a session happens, to which endpoint, over which protocol, and whether it completes - and on a mixed office VLAN a substantial fraction of the endpoints were never in the encrypted set at all. So the honest statement is that encryption removed one class of value from the position and left several others intact, which is a good reason to keep improving encryption coverage and a bad reason to close the finding.