5 ms·

> So this very much looks like evidence of an active system-wide certificate pinning mechanism protecting against MITM attacks on high-value Microsoft domains.

> So this very much looks like evidence of an active system-wide certificate pinning mechanism protecting against MITM attacks on high-value Microsoft domains. Which, per se, is a good thing! I feel like a broken record, but no, if you can't turn this off, it is not a good thing! It means you can never use an HTTPS proxy and know exactly what data is streaming off of your computer.

besselheim 10y ago
You can, you just need to have someone reverse engineer the pinning mechanism first to figure out how to disable or bypass it, or alternatively, log the data being wrapped in TLS. Same as has been done on mobile platforms (e.g. HttPeek for iOS).
userbinator 10y ago
Indeed, a "MITM attack" is a good thing if you are the one inspecting the data. Obligatory story about having control over your computing enviroment: https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html
dpark 10y ago
Given that products like Fiddler still work against live.com domains on Windows 10, either the pinning isn't enabled, Fiddler knows how to bypass it, or this isn't actually related to pinning.
- ccrush 10y ago
  Or maybe the pinning isn't for IE, but for Windows sending MS hidden information it doesn't want you to know about.
  - dpark 10y ago
    That's an awfully large list of domains for "hidden" telemetry. Hard to imagine why all of those would be specified for that. e.g. Some of those are just landing pages. Disclosure: Microsoft employee
micro_softy 10y ago
"I feel like a broken record..." But it needs to be said. No one is going to ever say it, but SSL/TLS can be used to better hide the fact that companies like Microsoft and Google are siphoning off quantities of personal data from people using their browsers. Sometimes a user wants to "MITM" themselves, i.e., set up an HTTPS proxy, to see what's being sent from their devices. That should always be an option available to the user. The motives of any company that starts making that more difficult to do should be questioned. These companies are legally obligated to put their interests first, not the user's interests. They can spin it to make it sound like they are advancing everyone's interests at once. But if they are not advancing their own interests first and foremost, then they are not doing their job. Users need to be more active in protecting their own interests. Fundamental to those is the ability to monitor one's own traffic, e.g., outgoing data. Any option that cannot be turned off ceases to be an "option". The recent story with Lenovo's BIOS favoring Windows 10 by not letting users disable a certain power management setting is another example.
z3t4 10y ago
You can be pretty sure they collect everything that is technically possible at scale. And that there is a back-door to your system in case they need any details. It feels good that they use encryption though. <sarcasm>

besselheim 10y ago

You can, you just need to have someone reverse engineer the pinning mechanism first to figure out how to disable or bypass it, or alternatively, log the data being wrapped in TLS. Same as has been done on mobile platforms (e.g. HttPeek for iOS).

userbinator 10y ago

Indeed, a "MITM attack" is a good thing if you are the one inspecting the data. Obligatory story about having control over your computing enviroment: https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html

dpark 10y ago

Given that products like Fiddler still work against live.com domains on Windows 10, either the pinning isn't enabled, Fiddler knows how to bypass it, or this isn't actually related to pinning.

ccrush 10y ago
Or maybe the pinning isn't for IE, but for Windows sending MS hidden information it doesn't want you to know about.
- dpark 10y ago
  That's an awfully large list of domains for "hidden" telemetry. Hard to imagine why all of those would be specified for that. e.g. Some of those are just landing pages. Disclosure: Microsoft employee

micro_softy 10y ago

"I feel like a broken record..." But it needs to be said. No one is going to ever say it, but SSL/TLS can be used to better hide the fact that companies like Microsoft and Google are siphoning off quantities of personal data from people using their browsers. Sometimes a user wants to "MITM" themselves, i.e., set up an HTTPS proxy, to see what's being sent from their devices. That should always be an option available to the user. The motives of any company that starts making that more difficult to do should be questioned. These companies are legally obligated to put their interests first, not the user's interests. They can spin it to make it sound like they are advancing everyone's interests at once. But if they are not advancing their own interests first and foremost, then they are not doing their job. Users need to be more active in protecting their own interests. Fundamental to those is the ability to monitor one's own traffic, e.g., outgoing data. Any option that cannot be turned off ceases to be an "option". The recent story with Lenovo's BIOS favoring Windows 10 by not letting users disable a certain power management setting is another example.

z3t4 10y ago

You can be pretty sure they collect everything that is technically possible at scale. And that there is a back-door to your system in case they need any details. It feels good that they use encryption though. <sarcasm>