3 ms·

What kind of security professional is this Gaurang Pandya? As far as I know it's common knowledge that both Nokia (on their Asha-series) and Opera Mini uses a p

What kind of security professional is this Gaurang Pandya? As far as I know it's common knowledge that both Nokia (on their Asha-series) and Opera Mini uses a proxy server to compress the data. From Opera Mini's wikipage (http://en.wikipedia.org/wiki/Opera_Mini http://en.wikipedia.org/wiki/Opera_Mini): "Unlike straightforward web browsers, Opera Mini fetches all content through a proxy server and reformats web pages into a format more suitable for small screens." And on Nokia developer's home page (http://www.developer.nokia.com/Develop/Series_40/Nokia_Browser_for_Series_40/ http://www.developer.nokia.com/Develop/Series_40/Nokia_Brows...): "The Nokia Xpress Browser comprises a client and a cloud-based proxy service. When a user requests a web page the proxy reads the page, processes CSS and JavaScript code, and compresses its content, which is then delivered to the client for display on the user's phone."

fleitz 14y ago
You'll notice that the page doesn't say: "We route your banking and other sensitive personal information through our servers and are at liberty to inspect any financial transactions conducted through this phone, this process works similarly to the great firewall of China." Many services use proxies to speed up connections, few do it with SSL, and even fewer forge their own certs.
- adrianmsmith 14y ago
  > You'll notice that the page doesn't say: "We route your banking and other sensitive personal information through our servers and are at liberty to inspect any financial transactions conducted through this phone It says "When a user requests a web page the proxy reads the page ... which is then delivered to the client for display on the user's phone." So if your "banking and other sensitive personal information" is a web page, then it does indeed say that.
- Maakuth 14y ago
  If part of the rendering engine runs in their servers and not in the phone, there's no chance of keeping the end-to-end encryption. Their servers need to decrypt the traffic to render it and then (hopefully!) re-encrypt it to safely deliver it to the phone. This is exactly the same as with Opera Mini and Amazon Silk.
- skrebbel 14y ago
  This is exactly why my bank blocks out Opera Mini. Which is excellent of them. I use Mini for everything except banking now, and it works like a charm
  - mqzaidi 14y ago
    But if Nokia can go to the extent of forging SSL, what stops them from using a different User Agent and pass through the block?
- tomp 14y ago
  Opera Mini is not a web browser; it can't process and render HTML+CSS+JavaScript, it only displays what the proxy servers tell it to (they do all the processing). So, you can't reasonably expect it to fetch HTTPS content and render it by itself. Especially since it's made to run on low-end phones.

fleitz 14y ago

You'll notice that the page doesn't say: "We route your banking and other sensitive personal information through our servers and are at liberty to inspect any financial transactions conducted through this phone, this process works similarly to the great firewall of China." Many services use proxies to speed up connections, few do it with SSL, and even fewer forge their own certs.

adrianmsmith 14y ago
> You'll notice that the page doesn't say: "We route your banking and other sensitive personal information through our servers and are at liberty to inspect any financial transactions conducted through this phone It says "When a user requests a web page the proxy reads the page ... which is then delivered to the client for display on the user's phone." So if your "banking and other sensitive personal information" is a web page, then it does indeed say that.
Maakuth 14y ago
If part of the rendering engine runs in their servers and not in the phone, there's no chance of keeping the end-to-end encryption. Their servers need to decrypt the traffic to render it and then (hopefully!) re-encrypt it to safely deliver it to the phone. This is exactly the same as with Opera Mini and Amazon Silk.
skrebbel 14y ago
This is exactly why my bank blocks out Opera Mini. Which is excellent of them. I use Mini for everything except banking now, and it works like a charm
- mqzaidi 14y ago
  But if Nokia can go to the extent of forging SSL, what stops them from using a different User Agent and pass through the block?
tomp 14y ago
Opera Mini is not a web browser; it can't process and render HTML+CSS+JavaScript, it only displays what the proxy servers tell it to (they do all the processing). So, you can't reasonably expect it to fetch HTTPS content and render it by itself. Especially since it's made to run on low-end phones.