4 ms·
Man in the middle attacks are more common than you'd think. Many corporate networks inspect outbound network traffic. I've heard of some coffee shop WiFi spots
by jdavis703 9y ago
Man in the middle attacks are more common than you'd think. Many corporate networks inspect outbound network traffic. I've heard of some coffee shop WiFi spots that also modify traffic to inject ads. Having someone tamper with your traffic, is a big deal. Especially consider many websites people visit are sensitive in nature, e.g. Google almost certainty knows more about me than any other human being -- they might even know more about me than I know about myself.
- Silhouette 9y agoMost corporate networks are going to inspect or block HTTPS traffic too. They have security and regulatory compliance concerns, and consequently deploying tools capable of intercepting that traffic is pretty much the norm these days. It's all but certain that if you have a work PC then your contract/handbook/etc. states that this may happen, unless you're in an area where the legal basis for this sort of inspection is weaker. Protecting people who aren't at work but are using a potentially hostile network (public WiFi, etc.) from their own device is certainly a legitimate concern.
- fiddlerwoaroof 9y agoOf course, this is a feature in certain contexts: I’d love to be able to inspect all the traffic going in and out of my home network and possibly even modifying it at the edge device.
- MaulingMonkey 9y agoTry fiddler. I've inspected my own HTTPS traffic a number of times using it including e.g. traffic from e.g. iPads where my Desktop was effectively acting as "the edge device". Of course, this is more for debugging than aggregate statistics/monitoring... This won't let you inspect traffic secured via certificate pinning without additional reverse engineering to figure out how to replace the pinned cert, but it'll work fine for vanilla HTTPS / generic CA based stuff (e.g. all browser traffic.)
- IncRnd 9y ago> This won't let you inspect traffic secured via certificate pinning without additional reverse engineering to figure out how to replace the pinned cert Replacing a cert doesn't get around cert pinning. That is the exact use case that cert pinning protects against.
- tzahola 9y agoThey meant replacing the cert fingerprint in the app that’s using cert pinning.
- IncRnd 9y agoThat makes sense. Thank you.
- fiddlerwoaroof 9y agoCouldn’t a mitm proxy just strip out the relevant headers?
- IncRnd 9y agoIt appears you're talking about pinning in browsers only, so I'll address from that perspective only. For public certs: Yes, but that would only produce the desired effect if the site hadn't yet been pinned, and this was a first connection, or in the case of the pins having expired. In other words, the pinning can only be stripped out if there is no pinning already in place on the client. However, this will soon be a moot point, as Chrome removes pinning in favor of cert transparency. This will reopen this security hole in browsers simply trying to be secure within captive portals and other insecure networks. Tor has pinning that would extend from inside the portal to outside, so that may be one option, but I don't yet know how sturdy that is.
- andrewaylett 9y agoFirefox at least will disable pinning if it sees a certificate signed by a user-supplied CA, on the one hand to facilitate this kind of debugging and on the other because otherwise enterprises using MITM boxes wouldn't be able to use Firefox. I suspect Chrome does too.