5 ms·
I would absolutely love to have control over HTTPS traffic on my network, specifically to enable my Squid proxy to cache HTTPS pages, but unfortunately not ever
by LanternLight83 6y ago
I would absolutely love to have control over HTTPS traffic on my network, specifically to enable my Squid proxy to cache HTTPS pages, but unfortunately not every device or even program supports custom CA's. I'd be the man-in-the-middle between the internet and every device I own.
- shawnz 6y agoI think that is a pretty user-hostile attitude and I suspect you probably wouldn't really love it if every network operator was doing that kind of thing.
- fiddlerwoaroof 6y agoWhat’s user-hostile is every consumer device insisting on pushing its defaults and ignoring any network policies I’ve configured.
- shawnz 6y agoYes, I agree that is also user-hostile, since it should be configurable. The problem is not about network policies though, since DHCP is explicitly not designed to be a policy and is purposely meant to be optional for the client. For this reason I wouldn't recommend buying a device like the Chromecast, in which the user can't configure the network settings. Instead maybe consider something like the Amazon Fire Stick which is not as user-hostile.
- mrmanner 6y agoI read that as LanternLight83 is both the network operator and the user in this case, and if so it’s not really a problem. I would also love to MitM myself in some cases, mostly because it’d be interesting to see what’s going on.
- shawnz 6y agoYes, but my point is that if you feel it's justified for your own network then you ought to expect every other network operator will feel that way about their network too. So before applying that mentality, it would be wise to consider what your experience would be like if all your neighbours, friends, colleagues etc also did that on their networks.
- fiddlerwoaroof 6y agoI have no problem with that: if my workplace MITMs traffic, I’ll use my cellphone connection and a personal laptop for sensitive data. If a friend’s house mitms traffic, same deal.
- mrmanner 6y agoIs the point that I sometimes use these networks? Then I somewhat agree - I would set up a separate guest network without shenanigans for guests to use. This avoids both the ethical sketchiness and having to explain why their web browser is shouting at them
- shawnz 6y agoTrue, that could be a good compromise. Although there are still some disadvantages like creating an SPoF for yourself and increasing your attack surface (e.g. anyone who compromises your internal CA has access to all your encrypted connections)
- BrandonM 6y agoYou don’t need to MitM. Squid can use SNI to allow whitelisted hosts, for now at least.
- shawnz 6y agoHopefully that will be fixed with widespread usage of TLS ESNI/ECH