4 ms·
Large employers fake GOOG certificates and spy on employee's search queries. They usually won't do that for DDG and smaller portals.
by gesman 8y ago
Large employers fake GOOG certificates and spy on employee's search queries.
They usually won't do that for DDG and smaller portals.
- mattlondon 8y agoNews to me! Interesting - do you have a source for that? Surely browsers will be flagging up HTTPS warnings for this?
- xfitm3 8y agoCommercial products like BlueCoat proxies do this. You won't see a warning because the CA of the proxy will be trusted on your system by your administrator. Certificate pinning with HSTS/HPKP isn't effective as the proxy can strip those headers in the response. https://security.stackexchange.com/questions/33976/man-in-the-middle-blue-coat-proxy-ssl-or-what https://security.stackexchange.com/questions/33976/man-in-th...
- move-on-by 8y agoThere is a fantastic paper on how these proxies often lower security: "The Security Impact of HTTPS Interception" [1]. The paper also provides some interesting ways of detecting this type of proxy on the server (and client too - although a client should know if they have custom trusted certs). mitm.watch has implemented the details of the paper. [1] https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf [2] https://mitm.watch/ https://mitm.watch/
- deleted 8y ago[deleted]
- aikah 8y agoOr you know use, your phone on data plan instead of corporate network for anything private.
- paradite 8y agoWould it be possible to detect this by inspecting the certificate information manually?
- gesman 8y agoYes, 100%. Just click on a lock icon in browser and drill down. Eventually you'll see the weirdness that Google certificate (as well as Linkedin and some others) are issued by BlueCoat or something like that. Big banks do that.