3 ms·
News to me! Interesting - do you have a source for that? Surely browsers will be flagging up HTTPS warnings for this?
by mattlondon 8y ago
News to me! Interesting - do you have a source for that? Surely browsers will be flagging up HTTPS warnings for this?
- xfitm3 8y agoCommercial products like BlueCoat proxies do this. You won't see a warning because the CA of the proxy will be trusted on your system by your administrator. Certificate pinning with HSTS/HPKP isn't effective as the proxy can strip those headers in the response. https://security.stackexchange.com/questions/33976/man-in-the-middle-blue-coat-proxy-ssl-or-what https://security.stackexchange.com/questions/33976/man-in-th...
- move-on-by 8y agoThere is a fantastic paper on how these proxies often lower security: "The Security Impact of HTTPS Interception" [1]. The paper also provides some interesting ways of detecting this type of proxy on the server (and client too - although a client should know if they have custom trusted certs). mitm.watch has implemented the details of the paper. [1] https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf [2] https://mitm.watch/ https://mitm.watch/