The key thing which FalseCONNECT demonstrated was that HTTPS in combination with a web proxy wasn't sufficient. This was a case where everyone assumed that usi

The key thing which FalseCONNECT demonstrated was that HTTPS in combination with a web proxy wasn't sufficient. This was a case where everyone assumed that using HTTPS via a web proxy would be safe to the point Microsoft even enabled auto-proxy support by default in Windows. Unfortunately, a few mistakes made in the implementation and the assumption that HTTPS was safe when using a web proxy no longer held true.