4 ms·

Reading the title ... no shit.

• jupp0r 10y ago
  Exactly my idea, but after reading the article I'm severely disappointed that the whole practice isn't declared bad. Instead it only points out that some mitm boxes are even more broken than I though possible and mess up cert validation.
  • jaimex2 10y ago
    It's a terrible practice, the article doesn't even go into some other things like how easy is it to actually break into the intercepting software and steal the private cert so you can mitm the network for free! and I'm a dev at one of these companies! We really didn't want to add the feature but we were bleeding customer's who for some reason had to have it. ( Yes, we do validate the certificates ) We decided to bite the bullet when it looked like even Google was "supporting" being mitmed as a customer pointed out. Reading this article... https://support.google.com/a/answer/1668854?hl=en https://support.google.com/a/answer/1668854?hl=en was my biggest "fuck you" moment.