3 ms·
Commercial products like BlueCoat proxies do this. You won't see a warning because the CA of the proxy will be trusted on your system by your administrator. Ce
by xfitm3 8y ago
Commercial products like BlueCoat proxies do this. You won't see a warning because the CA of the proxy will be trusted on your system by your administrator.
Certificate pinning with HSTS/HPKP isn't effective as the proxy can strip those headers in the response.
https://security.stackexchange.com/questions/33976/man-in-the-middle-blue-coat-proxy-ssl-or-what https://security.stackexchange.com/questions/33976/man-in-th...
- move-on-by 8y agoThere is a fantastic paper on how these proxies often lower security: "The Security Impact of HTTPS Interception" [1]. The paper also provides some interesting ways of detecting this type of proxy on the server (and client too - although a client should know if they have custom trusted certs). mitm.watch has implemented the details of the paper. [1] https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf [2] https://mitm.watch/ https://mitm.watch/