3 ms·
Just curious what the whitelist is... Chrome's pinned certs? That's always a point of curiosity for me: no one knows what Chrome is sending to Google.
by j_s 14y ago
Just curious what the whitelist is... Chrome's pinned certs? That's always a point of curiosity for me: no one knows what Chrome is sending to Google.
- moxie 14y agoChrome's pinning logic is disabled for connections where the signing cert was added to the trust store by a user, I think largely in part to avoid breaking these type of corporate MITM proxies. So if you want to watch the traffic, it should be as simple as MITMing yourself with a cert you add to the Chrome trust DB.
- loeg 14y agoI don't want my corp firewall spying on net traffic, so I don't add them to the trusted CAs DB. It would be slightly more palatable if the firewall did cert validation on the other side of things… but they don't.
- loeg 14y agoNo, they MITM google as well as everyone else. The whitelist includes yelp, for some reason... not really sure what else. I definitely do not add their MITM CA as a trusted root in my browser...