3 ms·
Marking HTTP as non-secure implies that HTTPS is secure. The large company where I work has quietly rolled out the Zscaler HTTPS proxy and my colleagues are una
by steve_taylor 12y ago
Marking HTTP as non-secure implies that HTTPS is secure. The large company where I work has quietly rolled out the Zscaler HTTPS proxy and my colleagues are unaware that, despite the assurance given by the green padlock in their browser, their connection is most definitely not secure.
- eli 12y agoIn that case isn't the problem that their employer installed their own root certificate? The employer could just as well have installed any manner of malware. In the scenario where you are not the administrator of the computer, nothing is secure.
- tomjen3 12y agoThat is because browsers obey the false root certificate installed locally, even when they otherwise pin the certificate down. This is a deliberate choice, but that doesn't mean HTTPS isn't secure, it means that you can't trust a computer you don't control.