4 ms·

How do you MITM TLS?

• simonw 2y ago
  Right - MITM isn’t a threat here.
  • ellellem 2y ago
    [flagged]
    • simonw 2y ago
      Don’t try to support your arguments by pasting paragraphs of text from ChatGPT. That said, there is a little nugget of useful information in there: “To do this, they install a corporate root certificate on all employee devices.” This is true: if you are using a device which has had a root certificate installed on it you are vulnerable to MITM attacks. I would argue that your employer stealing your Anthropic API key is a pretty low risk compared to everything else that is wrong with that scenario! Your original message above also mentioned coffee shop WiFi: that’s not a threat here. Your coffee shop has not installed a root certificate in your device.
      • ellellem 2y ago
        [flagged]
        • jaggs 2y ago
          "Don’t try to support your arguments by pasting paragraphs of text from ChatGPT." Agreed. Please don't do this.
      • kreetx 2y ago
        Yup, for development purposes I've used a self-generated root and signed certificates for it (and I also understand the risks). Though, on topic, Claude enabling access for browsers adds nothing specific to this risk - it's a generic risk for any TLS connection.