> it is evident that Nokia is performing Man In The Middle Attack for sensitive HTTPS traffic originated from their phone I took this statement at face value,

> it is evident that Nokia is performing Man In The Middle Attack for sensitive HTTPS traffic originated from their phone I took this statement at face value, and interpreted it to mean that Nokia was "MITMing" end-to-end SSL connections from the phone to the endpoint. If I understand you correctly, and using the VNC analogy, in actual fact the SSL connection is being initiated on a Nokia server by a browser I am running remotely via my phone. And while Nokia does in fact see the decrypted data coming out of the SSL pipe on their server, before they send it to the phone, this would always be an obvious consequence of running a browser to a SSL website via a VNC connection. So the above claim is either a falsehood or at best misleading. Torch extinguished (for now). > btw your idea of how SSL works is not entirely correct I certainly don't claim to have any expertise in SSL, but this did surprise me somewhat. I assumed that when Chrome tells me that "The identity of this website has been verified..." that it had in fact contacted a CA and validated the cert. I might have to read up on this a bit more.