4 ms·

I can't find any information about this. Can you point me at some additional information? Thank you in advance!

nostromo 10y ago
Here's a good write-up on how to see if your company is listening in on your encrypted web traffic: http://security.stackexchange.com/a/2920 http://security.stackexchange.com/a/2920 (Note: MITM is just one way companies monitor employees, but by no means the only way. If your company provided your work computer to you, or if they installed anything on your BYOD computer, I would treat everything you do on that computer as cc'ed to your boss by default.)
- colemickens 10y ago
  I mean, that's how I MITM SSL traffic on a daily basis to do development. None of that speaks to HSTS/Pinning... which is the feature meant to protect against this sort of thing. I'm specifically asking about how a company can bypass HSTS/Pinning without modifying my local browser. Everything I'm reading indicates that's not possible.
  - nostromo 10y ago
    https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/Security/Public... >Firefox (and Chrome) disable Pin Validation for Pinned Hosts whose validated certificate chain terminates at a user-defined trust anchor (rather than a built-in trust anchor). This means that for users who imported custom root certificates all pinning violations are ignored. That last sentence is key. From Wikipedia: some browsers "disable pinning for certificate chains with private root certificates to enable various corporate content inspection scanners and web debugging tools. The RFC 7469 standard also recommends disabling pinning violation reports for such certificate chains."
    - colemickens 10y ago
      Perfect! This is the missing link! Thank you for helping me understand.
    - cplease 10y ago
      What does that have to do with wifi certificates?
      - detaro 10y ago
        If you add CA certificates for the Wifi they probably (I'm not sure if you can tell it manually to not do that) are added to the system-wide trust store. IE and Chrome check that for CAs, Firefox will soon (https://bugzilla.mozilla.org/show_bug.cgi?id=1265113 https://bugzilla.mozilla.org/show_bug.cgi?id=1265113) (all this for Windows, I believe the same is true for OS X, Linux depends on your specific your setup)
        cplease 10y ago
        > If you add CA certificates for the Wifi they probably (I'm not sure if you can tell it manually to not do that) are added to the system-wide trust store. Internet Properties -> Content -> Certificates -> Advanced

Here's a good write-up on how to see if your company is listening in on your encrypted web traffic: http://security.stackexchange.com/a/2920 http://security.stackexchange.com/a/2920 (Note: MITM is just one way companies monitor employees, but by no means the only way. If your company provided your work computer to you, or if they installed anything on your BYOD computer, I would treat everything you do on that computer as cc'ed to your boss by default.)

colemickens 10y ago
I mean, that's how I MITM SSL traffic on a daily basis to do development. None of that speaks to HSTS/Pinning... which is the feature meant to protect against this sort of thing. I'm specifically asking about how a company can bypass HSTS/Pinning without modifying my local browser. Everything I'm reading indicates that's not possible.
- nostromo 10y ago
  https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/Security/Public... >Firefox (and Chrome) disable Pin Validation for Pinned Hosts whose validated certificate chain terminates at a user-defined trust anchor (rather than a built-in trust anchor). This means that for users who imported custom root certificates all pinning violations are ignored. That last sentence is key. From Wikipedia: some browsers "disable pinning for certificate chains with private root certificates to enable various corporate content inspection scanners and web debugging tools. The RFC 7469 standard also recommends disabling pinning violation reports for such certificate chains."
  - colemickens 10y ago
    Perfect! This is the missing link! Thank you for helping me understand.
  - cplease 10y ago
    What does that have to do with wifi certificates?
    - detaro 10y ago
      If you add CA certificates for the Wifi they probably (I'm not sure if you can tell it manually to not do that) are added to the system-wide trust store. IE and Chrome check that for CAs, Firefox will soon (https://bugzilla.mozilla.org/show_bug.cgi?id=1265113 https://bugzilla.mozilla.org/show_bug.cgi?id=1265113) (all this for Windows, I believe the same is true for OS X, Linux depends on your specific your setup)
      - cplease 10y ago
        > If you add CA certificates for the Wifi they probably (I'm not sure if you can tell it manually to not do that) are added to the system-wide trust store. Internet Properties -> Content -> Certificates -> Advanced