4 ms·

Not necessarily. If you control the gateway, it's possible to transparently redirect outbound connections into your proxy. I used to do this back in the 90s t

Not necessarily. If you control the gateway, it's possible to transparently redirect outbound connections into your proxy. I used to do this back in the 90s to force our employees browsers through an ad-blocking proxy. Depending on your user base (kids?), it could be as simple as setting up an open wifi access point in a place where all other APs are password-locked. Edit: I just realized that this proxy requires the device users to load a CA cert. That makes things a little more difficult but still not impossible. Through creative social/software engineering, you might be able to persuade the users of your rogue access point to load the CA cert "in order to use this free service".

brazzledazzle 12y ago
Yes, but they would be clued in because the SSL certificate wouldn't be valid unless they trust your CA.
- downandout 12y ago
  That's pretty trivial for parents. "Hey pumpkin, I need to borrow your phone for a second". That said this is something that maybe 0.1% of parents could or would set up.
  - chrissnell 12y ago
    Good point, but it's an interesting idea. An open-source home firewall that's designed with features/sniffers that lets parents keep an eye on their kids' online usage.
    - downandout 12y ago
      I was thinking the same thing. Call it Kidsafe or something. Make it automatically configure the router and let parents access the info online. Most phones are programmed to use wifi at home - seems like a promising opportunity.
  - Cthulhu_ 12y ago
    "Oh my GAWD MOM! YOU ALWAYS DO THIS! squeals hysterically"
- maccard 12y ago
  Have you met a teenager? They will blindly just click ignore/ok until they can do what they want. an invalid cert error isn't going to stop them unless it actually blocks (rather than warns and lets them proceed)
  - ColinDabritz 12y ago
    In fact, most users will behave this way, it's not exclusive to teenagers.
  - iancarroll 12y ago
    Pretty sure you can't hit OK on this one, it'll just hard fail.
cpach 12y ago
If Mallory can install an arbitrary root certificate on Alice’s client, M can do nearly whatever she wants with A’s client.
userbinator 12y ago
I've been using the same setup locally for years - ad-blocking/page-rewriting proxy to MITM the browsers on my machine and filter parts of pages that I don't want to even reach the browser. If Snapchat required each user have a separate public/private keypair (which would be transferred through other means, maybe even in-person), like what SSH uses, then they would be less amenable to being MITM'd via a single centralised trusted authority.

brazzledazzle 12y ago

Yes, but they would be clued in because the SSL certificate wouldn't be valid unless they trust your CA.

downandout 12y ago
That's pretty trivial for parents. "Hey pumpkin, I need to borrow your phone for a second". That said this is something that maybe 0.1% of parents could or would set up.
- chrissnell 12y ago
  Good point, but it's an interesting idea. An open-source home firewall that's designed with features/sniffers that lets parents keep an eye on their kids' online usage.
  - downandout 12y ago
    I was thinking the same thing. Call it Kidsafe or something. Make it automatically configure the router and let parents access the info online. Most phones are programmed to use wifi at home - seems like a promising opportunity.
- Cthulhu_ 12y ago
  "Oh my GAWD MOM! YOU ALWAYS DO THIS! squeals hysterically"
maccard 12y ago
Have you met a teenager? They will blindly just click ignore/ok until they can do what they want. an invalid cert error isn't going to stop them unless it actually blocks (rather than warns and lets them proceed)
- ColinDabritz 12y ago
  In fact, most users will behave this way, it's not exclusive to teenagers.
- iancarroll 12y ago
  Pretty sure you can't hit OK on this one, it'll just hard fail.

cpach 12y ago

If Mallory can install an arbitrary root certificate on Alice’s client, M can do nearly whatever she wants with A’s client.

userbinator 12y ago

I've been using the same setup locally for years - ad-blocking/page-rewriting proxy to MITM the browsers on my machine and filter parts of pages that I don't want to even reach the browser. If Snapchat required each user have a separate public/private keypair (which would be transferred through other means, maybe even in-person), like what SSH uses, then they would be less amenable to being MITM'd via a single centralised trusted authority.