3 ms·

Ever heard of HTTPS? Ever heard of SSL MITM Proxy? Required by law (and corporate compliance departments) in many industries. Also, cloudflare. They are the

Ever heard of HTTPS? Ever heard of SSL MITM Proxy? Required by law (and corporate compliance departments) in many industries. Also, cloudflare. They are the MITM for what, like 80% of the internet now?

red_admiral 2y ago
Cloudflare does not fiddle with or inject JS without the server's consent. They're not comcast.
- karma_pharmer 2y ago
  /me laughs so hard that milk shoots out of his nose
  - nolist_policy 2y ago
    This. The Cloudflare captcha page exists and will send you in an endless loop while you're on a 3g connection.
    - username923409 2y ago
      Not sure if this is the same kind of "endless loop" that I've experience on the Cloudflare captcha page; while on a VPN, the only way I can get past the "I am a Human" captcha is to refresh the page and click the area where the checkbox appears as fast as I can with my mouse before it even appears. It might take two or three tries, but it hasn't failed yet. I have no idea why this works so well, but I haven't found another way (other than getting off of my VPN) to get past this screening page.
zarzavat 2y ago
This doesn’t work unless you have access to the device, which mobile ISPs surely don’t. Some countries might mandate it but I don’t think it’s a feature to make your websites police state approved.
- bravetraveler 2y ago
  Corporate is the key part being missed here They provide the device(s), they have access to it. Countless ways to mess with the trust. If anyone thinks they're safe from their employer due to SSL, lol.
  - zarzavat 2y ago
    I know that but the original comment was in response to: > Does their ISP or mobile operator interfere with downloaded JavaScript? In any case, if some rogue corporate proxy breaks your website, then either they pay you to fix it or you tell them to get lost.
    - bravetraveler 2y ago
      Totally fair, not a judgement - just being a reminder down here in the thread
apienx 2y ago
> Required by law (and corporate compliance departments) in many industries. Could you please provide details about this?
- 7bit 2y ago
  Also very curious about this. And yes, there are companies that do that - and then it's usually called Deep Packet Inspection or similar, not MITM, because that's a term attributed to malicious parties. And in that case, the proxy can both, manipulate the JS as well as the HTML, so the argument of the linked page is still faulty.
- 7bit 2y ago
  Ndjd she eje
- karma_pharmer 2y ago
  Here, knock yourself out: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query="ssl+inspection"&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=zscaler&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... https://finance.yahoo.com/news/zscaler-announces-fedramp-process-milestone-130000216.html https://finance.yahoo.com/news/zscaler-announces-fedramp-pro...
  - apienx 2y ago
    Thank you. I don’t doubt that certain governments twist the arms of companies for privileged access. From my understanding, however, those practices are not the norm in the west (and certainly not overtly codified). IMHO, 90%+ of the data captured in the “West” is from exploits and such.
sccxy 2y ago
> Also, cloudflare. They are the MITM for what, like 80% of the internet now? Please give source for that claim where Cloudflare implements man-in-the-middle attack.
- kachapopopow 2y ago
  [dead]
- tasuki 2y ago
  The person you're replying to said cloudflare was the man in the middle. Not that they executed attacks.
Kwpolska 2y ago
Cloudflare may be MITM, but with the consent of the website owner. If they break JS (which I doubt they would), the website owner would certainly notice. Police states and "internet security" mal^H^H^Hsoftware may MITM stuff. If you're actually doing business with customers in those police states, you probably have someone local who can test. "Internet security" software is unlikely to break things just to insert ads (as the ISP mentioned in the post did over plain HTTP).
deleted 2y ago
[deleted]

red_admiral 2y ago

Cloudflare does not fiddle with or inject JS without the server's consent. They're not comcast.

karma_pharmer 2y ago
/me laughs so hard that milk shoots out of his nose
- nolist_policy 2y ago
  This. The Cloudflare captcha page exists and will send you in an endless loop while you're on a 3g connection.
  - username923409 2y ago
    Not sure if this is the same kind of "endless loop" that I've experience on the Cloudflare captcha page; while on a VPN, the only way I can get past the "I am a Human" captcha is to refresh the page and click the area where the checkbox appears as fast as I can with my mouse before it even appears. It might take two or three tries, but it hasn't failed yet. I have no idea why this works so well, but I haven't found another way (other than getting off of my VPN) to get past this screening page.

zarzavat 2y ago

This doesn’t work unless you have access to the device, which mobile ISPs surely don’t. Some countries might mandate it but I don’t think it’s a feature to make your websites police state approved.

bravetraveler 2y ago
Corporate is the key part being missed here They provide the device(s), they have access to it. Countless ways to mess with the trust. If anyone thinks they're safe from their employer due to SSL, lol.
- zarzavat 2y ago
  I know that but the original comment was in response to: > Does their ISP or mobile operator interfere with downloaded JavaScript? In any case, if some rogue corporate proxy breaks your website, then either they pay you to fix it or you tell them to get lost.
  - bravetraveler 2y ago
    Totally fair, not a judgement - just being a reminder down here in the thread

apienx 2y ago

> Required by law (and corporate compliance departments) in many industries. Could you please provide details about this?

7bit 2y ago
Also very curious about this. And yes, there are companies that do that - and then it's usually called Deep Packet Inspection or similar, not MITM, because that's a term attributed to malicious parties. And in that case, the proxy can both, manipulate the JS as well as the HTML, so the argument of the linked page is still faulty.
7bit 2y ago
Ndjd she eje
karma_pharmer 2y ago
Here, knock yourself out: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query="ssl+inspection"&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=zscaler&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... https://finance.yahoo.com/news/zscaler-announces-fedramp-process-milestone-130000216.html https://finance.yahoo.com/news/zscaler-announces-fedramp-pro...
- apienx 2y ago
  Thank you. I don’t doubt that certain governments twist the arms of companies for privileged access. From my understanding, however, those practices are not the norm in the west (and certainly not overtly codified). IMHO, 90%+ of the data captured in the “West” is from exploits and such.

sccxy 2y ago

> Also, cloudflare. They are the MITM for what, like 80% of the internet now? Please give source for that claim where Cloudflare implements man-in-the-middle attack.

kachapopopow 2y ago
[dead]
tasuki 2y ago
The person you're replying to said cloudflare was the man in the middle. Not that they executed attacks.

Kwpolska 2y ago

Cloudflare may be MITM, but with the consent of the website owner. If they break JS (which I doubt they would), the website owner would certainly notice. Police states and "internet security" mal^H^H^Hsoftware may MITM stuff. If you're actually doing business with customers in those police states, you probably have someone local who can test. "Internet security" software is unlikely to break things just to insert ads (as the ISP mentioned in the post did over plain HTTP).

deleted 2y ago

[deleted]