3 ms·
You can still detect that you are intercepted by checking fingerprints and/or green bar https://www.grc.com/ssl/ev.htm https://www.grc.com/ssl/ev.htm ... don't
by mazsa 12y ago
You can still detect that you are intercepted by checking fingerprints and/or green bar https://www.grc.com/ssl/ev.htm https://www.grc.com/ssl/ev.htm ... don't you?
- kobigurk 12y agoYou will detect it even sooner - the root certificate that signs the certificates for the MITM is not recognized by your browser (unless you manually installed it). You will get a nice, big, red warning on every modern browser. The tool doesn't claim otherwise. An example useful usage is testing your app that communicates using SSL and seeing what's under the hood. In that case, you would install the root certificate manually so the app (or OS) wouldn't reject it.
- verytrivial 12y agoIt strike me that this tools works (or is perhaps designed to be?) a proof-of-concept for how things are done by those Agencies that keep showing up in the news. They will simply have (by hook-or-crook) several of the root cert private keys for the already-installed roots. There's a few dozen of them and any one will do. Just fry-up forged MITM certificates as needed. I doubt the target would even notice the tiny delay during handshake. As you say, no one checks fingerprints. I think fingerprints would only help if you had visited the site before without a MITM, and your SSL layer flagged changes under ALL circumstances, remembering the fried-up MITM cert will look 100% legit. I wonder if there is a privacy-protecting way to share certs/ids to detect these changes? (or is there one already?)