4 ms·
I did a contract in a corporate environment where the SSL interception proxy passed-through any site with an EV certificate. I first noticed that it wasn't int
by regecks 8y ago
I did a contract in a corporate environment where the SSL interception proxy passed-through any site with an EV certificate.
I first noticed that it wasn't intercepting my connection to my bank, and then after some experimentation, that turned out to be the pattern. Sounds stupid, but there you go, somebody uses EV as a signal for something.
- deleted 8y ago[deleted]
- crdoconnor 8y agoYou made me curious - I work at a company that does that. As it turns out it appears to intercept everything except connections to major high street banks.
- gruez 8y agoI wonder whether they're doing it by IP, DNS, SNI, or certificate. because if it's by SNI or DNS, it's pretty easy to get pass the intercepting proxy.
- crdoconnor 8y agoIt's by certificate although the company does run an HTTP proxy for techies that doesn't MITM certs. These days I can't be bothered to circumvent. If I want to do any sort of sensitive browsing at work (e.g. online banking) I just tether my laptop to my phone.