4 ms·
HTTPS on non-public resources isn't doesn't need to use DIY certs, normal certs work fine. If you are afraid of hostnames showing up in CT logs, you can use wil
by fulafel 4y ago
HTTPS on non-public resources isn't doesn't need to use DIY certs, normal certs work fine. If you are afraid of hostnames showing up in CT logs, you can use wildcard certs.
Also TLS traffic inspection and antivirus can be done at endpoints.
- palant 4y agoSure, antivirus software does inspection at the endpoints. Guess what: they usually employ their MITM CA for that. :-) It’s not like I haven’t written about that before. Here is a particularly disastrous implementation: https://palant.info/2019/08/19/kaspersky-in-the-middle--what-could-possibly-go-wrong/ https://palant.info/2019/08/19/kaspersky-in-the-middle--what...
- fulafel 4y agoYep, I think there are ways to do it without a MITM CA but they are more fragile. There's also this post https://www.securityweek.com/antivirus-software-has-negative-impact-https-security-researcher/ https://www.securityweek.com/antivirus-software-has-negative... Both are bad but network level is worse.