3 ms·

Ironic pop-up chat window: "Welcome <<wavy-hand emoji>> Thank you for being a Cofense customer. We <<heart emoji>> working with you and your team at Allianz.

Ironic pop-up chat window: "Welcome <<wavy-hand emoji>> Thank you for being a Cofense customer. We <<heart emoji>> working with you and your team at Allianz. How can we help you today?" I do not work at Allianz, but at another large German company that appears to share a web proxy service with Allianz, who are apparently Cofense customers (or Cofense believes they ought to be).

jesprenj 3y ago
Web proxy service? You browse through a web proxy? I thought this was an obsolete piece of protocol.
- JohnFen 3y ago
  It's not obsolete at all. It's more relevant than ever, imo. I do all of my browsing through a proxy (so that I can strip DoH requests out of the stream).
  - MandieD 3y ago
    Any recommendations for my personal use? I have no control over the one at work, and am pretty ok with that.
    - JohnFen 3y ago
      You probably don't want to do it my way -- I've cobbled it together and it works, but it's not pretty. In essence, what I've done is set up my router to intercept all HTTPS traffic and direct it to a proxy program that I wrote myself. All the program does is look for DoH traffic and drop it on the floor, just passing the rest on to its proper destination. This requires installing a custom cert on each browser so the proxy can decrypt the HTTPS stream. If I were to do this today, I'd look into formal tools to do this, such as mitmproxy or somesuch. That's not a specific recommendation, I've never used it. But there are a number of similar tools available. One of them is likely to be a good solution!
      - jesprenj 3y ago
        Why? Do you have some black boxes that keep calling some DoH and you can't control that but they accept user CAs?
- ThePowerOfFuet 3y ago
  Happens often in enterprise, where all web traffic is intercepted via TLS MITM and screened for malware, DLP, phishing, etc.
  - jesprenj 3y ago
    Thats fair, but an enterprise instalation I saw used a transparent proxy and certs on client machines. By transparent proxy I mean a DPI firewall that somehow "hijacked" normal TLS sessions. I don't really know why, a HTTP proxy would be the obvious solution ...

jesprenj 3y ago

Web proxy service? You browse through a web proxy? I thought this was an obsolete piece of protocol.

JohnFen 3y ago
It's not obsolete at all. It's more relevant than ever, imo. I do all of my browsing through a proxy (so that I can strip DoH requests out of the stream).
- MandieD 3y ago
  Any recommendations for my personal use? I have no control over the one at work, and am pretty ok with that.
  - JohnFen 3y ago
    You probably don't want to do it my way -- I've cobbled it together and it works, but it's not pretty. In essence, what I've done is set up my router to intercept all HTTPS traffic and direct it to a proxy program that I wrote myself. All the program does is look for DoH traffic and drop it on the floor, just passing the rest on to its proper destination. This requires installing a custom cert on each browser so the proxy can decrypt the HTTPS stream. If I were to do this today, I'd look into formal tools to do this, such as mitmproxy or somesuch. That's not a specific recommendation, I've never used it. But there are a number of similar tools available. One of them is likely to be a good solution!
    - jesprenj 3y ago
      Why? Do you have some black boxes that keep calling some DoH and you can't control that but they accept user CAs?
ThePowerOfFuet 3y ago
Happens often in enterprise, where all web traffic is intercepted via TLS MITM and screened for malware, DLP, phishing, etc.
- jesprenj 3y ago
  Thats fair, but an enterprise instalation I saw used a transparent proxy and certs on client machines. By transparent proxy I mean a DPI firewall that somehow "hijacked" normal TLS sessions. I don't really know why, a HTTP proxy would be the obvious solution ...