7 ms·

Useless. What would have been valuable would have been to generate a random private key at installation time. As it stands, it seems like the private key extrac

Useless. What would have been valuable would have been to generate a random private key at installation time. As it stands, it seems like the private key extracted can be used to mitm all Lenovo users.

danielweber 12y ago
Yes. There are a bunch of legit proxies that do this already, and they know that when they mess with SSL they need to be careful.
- chinathrow 12y ago
  Legit? Care to elaborate? I am really interested.
  - guscost 12y ago
    Debugging proxies like Fiddler (Windows) or Charles (Mac) generate a certificate if you want to inspect HTTPS.
  - userbinator 12y ago
    Some ad-removing proxies (basically the exact opposite of Superfish?) and antivirus need to do MITM on SSL as otherwise they would be completely ineffective against ads or malware served via SSL.
    - sillysaurus3 12y ago
      Is it true that an antivirus program like Microsoft Security Essentials installs a cert into the system cert store in order to MITM all network traffic?
      - barrkel 12y ago
        No. Some != all.
    - hurin 12y ago
      > otherwise they would be completely ineffective against ads or malware served via SSL. That's certainly false. HTTPS does not encode the routing headers, so it's still possible to block all traffic foreign to the host (or coming from a list of suspected malaware/add domains) without decoding the packets.
      - tedunangst 12y ago
        You're going to block all of AWS?
        hurin 12y ago
        >You're going to block all of AWS? a) You block post and get requests that go to external domain's which are either blacklisted or non-whitelisted. a) services hosted on AWS still have specific ips or ip ranges tied to domain names, so even if doubleclick is hosted on AWS there should be no problem ban-listing it. example: HTTPSwitchboard works quite well with some tuning without any MiTM proxying - as a matter of fact, I'm not sure what you would even gain from MiTM proxying, if an authenticated host wants to serve you malicious content they don't need to cross-domain reference, and you won't be able to distinguish it from non-malicious content. Proxying and decoding content at some point prior to final destination may be useful in certain very specific cases, but generally it's unnecessary and leads to more dangerous failure modes. So far I haven't seen a typical use-case for it explained, which cannot be achieved with other methods.
        userbinator 12y ago
        if an authenticated host wants to serve you malicious content they don't need to cross-domain reference, and you won't be able to distinguish it from non-malicious content. The point is that the MITM proxy can scan the traffic for malicious content and block it before e.g. it reaches a browser. HTTPSwitchboard works only in the browser, but that might be too late if it's a browser exploit on a new domain... or a browser that you cannot modify easily, like the embedded ones in various "smart" devices.
    - hellbanner 12y ago
      I thought ad-removing worked by just blocking requests to any site that's been blacklisted.

danielweber 12y ago

Yes. There are a bunch of legit proxies that do this already, and they know that when they mess with SSL they need to be careful.

chinathrow 12y ago
Legit? Care to elaborate? I am really interested.
- guscost 12y ago
  Debugging proxies like Fiddler (Windows) or Charles (Mac) generate a certificate if you want to inspect HTTPS.
- userbinator 12y ago
  Some ad-removing proxies (basically the exact opposite of Superfish?) and antivirus need to do MITM on SSL as otherwise they would be completely ineffective against ads or malware served via SSL.
  - sillysaurus3 12y ago
    Is it true that an antivirus program like Microsoft Security Essentials installs a cert into the system cert store in order to MITM all network traffic?
    - barrkel 12y ago
      No. Some != all.
  - hurin 12y ago
    > otherwise they would be completely ineffective against ads or malware served via SSL. That's certainly false. HTTPS does not encode the routing headers, so it's still possible to block all traffic foreign to the host (or coming from a list of suspected malaware/add domains) without decoding the packets.
    - tedunangst 12y ago
      You're going to block all of AWS?
      - hurin 12y ago
        >You're going to block all of AWS? a) You block post and get requests that go to external domain's which are either blacklisted or non-whitelisted. a) services hosted on AWS still have specific ips or ip ranges tied to domain names, so even if doubleclick is hosted on AWS there should be no problem ban-listing it. example: HTTPSwitchboard works quite well with some tuning without any MiTM proxying - as a matter of fact, I'm not sure what you would even gain from MiTM proxying, if an authenticated host wants to serve you malicious content they don't need to cross-domain reference, and you won't be able to distinguish it from non-malicious content. Proxying and decoding content at some point prior to final destination may be useful in certain very specific cases, but generally it's unnecessary and leads to more dangerous failure modes. So far I haven't seen a typical use-case for it explained, which cannot be achieved with other methods.
        userbinator 12y ago
        if an authenticated host wants to serve you malicious content they don't need to cross-domain reference, and you won't be able to distinguish it from non-malicious content. The point is that the MITM proxy can scan the traffic for malicious content and block it before e.g. it reaches a browser. HTTPSwitchboard works only in the browser, but that might be too late if it's a browser exploit on a new domain... or a browser that you cannot modify easily, like the embedded ones in various "smart" devices.
  - hellbanner 12y ago
    I thought ad-removing worked by just blocking requests to any site that's been blacklisted.