4 ms·

> do not use corporate "guest" wifi for your personal devices. Your employer is monitoring what you do on this network and may be man-in-the-middle-ing your SSL

> do not use corporate "guest" wifi for your personal devices. Your employer is monitoring what you do on this network and may be man-in-the-middle-ing your SSL connections. Unless I'm missing something, this is not possible (unless you install a certificate root supplied by your employer) because any man-in-the-image attempt would be flagged as a failed certificate authentication. Indeed, that's exactly why certificate chains tied to domain names exist.

daggersandscars 5y ago
Thank you for the clarification. I knew it was possible if you installed a work-provided certificate. I was not sure it was possible without one.
- GekkePrutser 5y ago
  It's not possible with SSL/TLS. But there are ways to downgrade to http in some cases. All the corporate inspection tools I know don't use this by the way. Many of these corporate inspection tools seem to leave traffic on nonstandard ports alone by the way, just saying ;)
nikau 5y ago
correct its not. They can however look at your DNS queries, and even if you use encrypted DNS they can still inspect the certificates of sites you are going to to figure out what the domain is. In the past it was possible to quickly swap the physical sata hard disk on some laptops to segregate work/personal use, but that's no longer viable with modern laptops. On the plus side carrying 2 modern laptops weighs the same as one oldshool laptop and they use the same usb-c charger...
- Scoundreller 5y ago
  > as one oldshool laptop and they use the same usb-c charger Be careful with this. My MacBook Air will charge off anything, including a 5V battery bank. My Dell won’t charge off anything less than 18V over USB-C. Got caught in a bind once when I brought my “slow” charger thinking that would be fine for light use on a trip away. It was not.
  - nikau 5y ago
    For sure, I use a lenovo 45Watt as its pretty compact and charges most laptops and phones.
unstatedAnswers 5y ago
Unless you work for Google, Apple, Cloudflare, Microsoft, Facebook, etc etc ;) Of course they’d lose their ability to issue public certificates if it became widely known, but they have it within their power.

daggersandscars 5y ago

Thank you for the clarification. I knew it was possible if you installed a work-provided certificate. I was not sure it was possible without one.

GekkePrutser 5y ago
It's not possible with SSL/TLS. But there are ways to downgrade to http in some cases. All the corporate inspection tools I know don't use this by the way. Many of these corporate inspection tools seem to leave traffic on nonstandard ports alone by the way, just saying ;)

nikau 5y ago

correct its not. They can however look at your DNS queries, and even if you use encrypted DNS they can still inspect the certificates of sites you are going to to figure out what the domain is. In the past it was possible to quickly swap the physical sata hard disk on some laptops to segregate work/personal use, but that's no longer viable with modern laptops. On the plus side carrying 2 modern laptops weighs the same as one oldshool laptop and they use the same usb-c charger...

Scoundreller 5y ago
> as one oldshool laptop and they use the same usb-c charger Be careful with this. My MacBook Air will charge off anything, including a 5V battery bank. My Dell won’t charge off anything less than 18V over USB-C. Got caught in a bind once when I brought my “slow” charger thinking that would be fine for light use on a trip away. It was not.
- nikau 5y ago
  For sure, I use a lenovo 45Watt as its pretty compact and charges most laptops and phones.

unstatedAnswers 5y ago

Unless you work for Google, Apple, Cloudflare, Microsoft, Facebook, etc etc ;) Of course they’d lose their ability to issue public certificates if it became widely known, but they have it within their power.