4 ms·
So they can mitm their own employees without annoying TLS warnings.
by Onavo 2y ago
So they can mitm their own employees without annoying TLS warnings.
- throwaway2037 2y agoTo be clear, this is bog standard in all mega-corps now. They have a vendor product that provides HTTP Internet proxy, then they perform MitM to decrypt HTTPS traffic and re-sign/encrypt with in-house issued cert. Then, this cert is auto-trusted as part of all base OS installations. To be honest, how else can mega-corps spy on HTTPS traffic without this MitM tactic? I don't know any other way.
- echoangle 2y agoYes, but normally this is done by making your own CA and installing it into your client devices, not by getting it into every device globally by working with Microsoft.
- hulitu 2y ago> Yes, but normally this is done by making your own CA and installing it into your client devices, not by getting it into every device globally by working with Microsoft. Google, Facebook, Microsoft, Apple, Cloudfare, Godaddy, Lets encrypt. They all "work with Microsoft".
- echoangle 2y agoDoes any employer get a certificate from any of the CAs you listed to MITM their internal networks?
- 3np 2y agoThe listed companies are employers. I think they all have self-managed CAs.
- echoangle 2y agoYes, but surely the listed companies don't use their public and globally trusted CAs to MITM their internal networks. I hope they have another internal CA to allow them to MITM their internal Network.
- tsimionescu 2y agoYou don't need a publicly trusted CA for that. You just run an internal CA and install its root certificate on your employees' machines, just like you install VPN software or whatever else.