3 ms·
Corporates be damned! (and they will be if they don't adapt). There are many issues here and you touch on one: MItM web proxies. To be honest it is pretty tri
by gerdesj 8y ago
Corporates be damned! (and they will be if they don't adapt). There are many issues here and you touch on one: MItM web proxies. To be honest it is pretty trivial to get Squid to do Bump and Splice so MiTM is a thing for anyone and not just corporates with expensive proxy toys.
In the Windows world, you have a weird collection of SSL/TLS settings available out of the box. Unfortunately you have at least three sets of these to worry about: SChannel, WinHTTP and .NET (this one has several sub versions). Updates enable extra features but some need reg keys to switch them on.
Then, once you get things tuned correctly so that TLS <1.2 is unavailable, something will need an older version and you have to switch it back on ... unless your IT security officer is also the Managing Director, which means I get to tell the whiner to piss off and fix their application. I do accept that I have a luxury unavailable to most people!