4 ms·
Enterprises MITMing traffic is wrong, regardless of any of this; It's pretty much the reason why Google has introduced Cert Pinning, as the 'security' aspect of
by GauntletWizard 14y ago
Enterprises MITMing traffic is wrong, regardless of any of this; It's pretty much the reason why Google has introduced Cert Pinning, as the 'security' aspect of those boxes is utter and complete bullshit.
- deadbea7 14y agoI can think of legitimate reasons for enterprises to MITM traffic. For example, protecting users against malware as a result of drive-by downloads or spear phishing campaigns. Data loss prevention is another good reason -- I would want an enterprise that I'm trusting with my credit card data to alert on payment instruments leaving their network to gmail accounts, for instance.
- rmc 14y agoData loss prevention is another good reason In some regions, companies are legally required to ensure personal data is protected. It's against the law for them to not protect it.
- rmc 14y agoEmployers often have legal responsibilites to their employees to ensure that those employees aren't exposed to ahem unprofessional content from other employees. The only real way to do this is to intercept and filter HTTPS traffic. Otherwise you're one HTTPS porn site away from a sexual harassment case.
- tptacek 14y agoThat's pretty silly. Enterprises are also obligated to ensure that random employees don't spirit out millions of customer account files over the Internet. If you want an unimpeded Internet connection, provide your own.
- mseebach 14y agoChrome will ignore the pin if there's manually installed CA on the client, exactly to allow corporate MITMing.