4 ms·
MITM tools such as [0] can also generate new certificates on the fly. So, unless HSTS is enabled, the user will still see the green padlock. This, obviously is
by prashnts 10y ago
MITM tools such as [0] can also generate new certificates on the fly. So, unless HSTS is enabled, the user will still see the green padlock.
This, obviously is only possible if the signing authority is in the device's trusted CAs. But I'd assume that corporate systems would have local CAs trusted by their admins.
[0] MITM Proxy https://mitmproxy.org https://mitmproxy.org
- lucaspiller 10y agoAlso it should be noted that Chromium will ignore certificate pinning if a private root certificate is used. So this will do nothing to prevent corporate snooping.
- pfg 10y agoWhich makes sense, because anyone who could install a root certificate on your system could easily disable any such check, backdoor Chrome, install a keylogger, etc. This would lead to a false sense of security, which I believe would be worse than the status quo.