3 ms·

SSL/TLS does not prevent all MITM, it prevents unwanted MITM. That’s news to me. Can you expand on this ? I always assumed if an API Endpoint for example is se

SSL/TLS does not prevent all MITM, it prevents unwanted MITM. That’s news to me. Can you expand on this ? I always assumed if an API Endpoint for example is served on TLS it’s secure till the termination. No ?

nicoburns 5y ago
You can always choose to install your own root certificates, at which point your browsers will trust any certificates issued by them (which could be your own mitm proxy)
- remh 5y ago
  It would cause issues for websites / apps using HSTS / Certificate pinning (a.k.a. most big websites)
  - makeworld 5y ago
    No, HSTS doesn't pin the cert, it just says that TLS must be used. A custom root certificate will fulfill that requirement. Cert pinning isn't used by browsers in general.
derimagia 5y ago
In practice it's usually done with SSL termination (MITM but you have a trusted certificate) Adguard Docs on it: https://kb.adguard.com/en/general/https-filtering#how-does-https-filtering-work https://kb.adguard.com/en/general/https-filtering#how-does-h... Charles Proxy: https://www.charlesproxy.com/documentation/proxying/ssl-proxying/ https://www.charlesproxy.com/documentation/proxying/ssl-prox...