4 ms·

> The freedom to modify your roots of trust is extremely important. I agree, modifying certificates shouldn't be technically impossible but perhaps we could ha

by kanox 8y ago

> The freedom to modify your roots of trust is extremely important. I agree, modifying certificates shouldn't be technically impossible but perhaps we could have regulations where companies that do this are penalized. If companies are expected to safeguard customer then facilitating MITM is a huge breach that should result in fines. A lot of root CAs are backed by national governments anyway, shouldn't they object to being impersonated? It's also extremely common for companies to install root certificates on work computers that employees use to check their personal email. Why is nobody objecting to this?

brokenmachine 8y ago
> It's also extremely common for companies to install root certificates on work computers that employees use to check their personal email. Why is nobody objecting to this? A question: if I'm on a work PC that has a root certificate installed, can you tell if they're using it to MITM? When I go to a site on my work PC with the padlock (eg my bank) and click to get more info, it does show the bank's certificate. Can they still be MITMing that connection?
- userbinator 8y ago
  Of course it will show the cert with the matching name, practically all MITMs will generate the correct certificates so that browsers don't complain. You need to look at the CA it's signed with, and compare to the one you get when you access the site from somewhere else. Also, It's also extremely common for companies to install root certificates on work computers that employees use to check their personal email. Why is nobody objecting to this? Because you do not own those computers, and they should not be used for non-work-related activity. The company policy will explicitly mention this, something like "all communications on company property are subjected to monitoring at all times."
  - brokenmachine 8y ago
    >Because you do not own those computers, and they should not be used for non-work-related activity. The company policy will explicitly mention this, something like "all communications on company property are subjected to monitoring at all times." Just as a thought experiment, lets say I set up a "free computer booth" on a street, but made people tick a box when they started that expressed the same conditions. Would I then be entitled to MITM and read all communications that passed through that machine? Why or why not?
    - userbinator 8y ago
      Yes. The owner always has the right to monitor what goes on with his/her property. If you remove that right (like what is happening on mobile devices, unfortunately), it's a slippery slope to a situation where no one has absolute ownership of what they "own", which is even more treacherous for privacy.
      - kanox 8y ago
        > Yes. The owner always has the right to monitor what goes on with his/her property. No. By this logic your ISP owns the cables and has the right to MITM as well.

by kanox 8y ago

brokenmachine 8y ago

> It's also extremely common for companies to install root certificates on work computers that employees use to check their personal email. Why is nobody objecting to this? A question: if I'm on a work PC that has a root certificate installed, can you tell if they're using it to MITM? When I go to a site on my work PC with the padlock (eg my bank) and click to get more info, it does show the bank's certificate. Can they still be MITMing that connection?

userbinator 8y ago
Of course it will show the cert with the matching name, practically all MITMs will generate the correct certificates so that browsers don't complain. You need to look at the CA it's signed with, and compare to the one you get when you access the site from somewhere else. Also, It's also extremely common for companies to install root certificates on work computers that employees use to check their personal email. Why is nobody objecting to this? Because you do not own those computers, and they should not be used for non-work-related activity. The company policy will explicitly mention this, something like "all communications on company property are subjected to monitoring at all times."
- brokenmachine 8y ago
  >Because you do not own those computers, and they should not be used for non-work-related activity. The company policy will explicitly mention this, something like "all communications on company property are subjected to monitoring at all times." Just as a thought experiment, lets say I set up a "free computer booth" on a street, but made people tick a box when they started that expressed the same conditions. Would I then be entitled to MITM and read all communications that passed through that machine? Why or why not?
  - userbinator 8y ago
    Yes. The owner always has the right to monitor what goes on with his/her property. If you remove that right (like what is happening on mobile devices, unfortunately), it's a slippery slope to a situation where no one has absolute ownership of what they "own", which is even more treacherous for privacy.
    - kanox 8y ago
      > Yes. The owner always has the right to monitor what goes on with his/her property. No. By this logic your ISP owns the cables and has the right to MITM as well.