4 ms·
Sorry I'm not sure I understand - how can you do TLS inspection without breaking the security promise TLS is supposed to provide?
by taf2 10y ago
Sorry I'm not sure I understand - how can you do TLS inspection without breaking the security promise TLS is supposed to provide?
- jstanley 10y agoIf you trust your proxy, and your software trusts your proxy's self-signed CA, then your proxy can MITM the connections and sign its own certificates, and you still know nobody "else" is listening.
- jcrawfordor 10y agoIt depends on who you trust. TLS inspection will break the security promise of TLS in a sense because your trust chain is no longer exclusively the operator of the website. However, the 'extra link' in that trust chain can be someone that you trust, for example an employer or trusted vendor. In this case, well implemented TLS interception changes the situation from "I trust google.com" to "I trust my employer and google.com", with proper cryptographic verification of both of those steps.
- Spooky23 10y agoThe owner of the computer and network can choose to trust itself, intercept traffic, and reencrypt using an organizational key.