It's fine to proxy HTTPS. But when you do so, you assume big responsibilities. You have to do all the stuff the browser does, and even lots of security people

It's fine to proxy HTTPS. But when you do so, you assume big responsibilities. You have to do all the stuff the browser does, and even lots of security people, if you sat them down and told them to write everything a browser does, would probably forget a few important things. (The browser security folks are exceptions.) The top post on this page ('patcheudor) is from a researcher who reports that Superfish wasn't doing proper validation of certs, meaning we didn't even need to extract the private key from the binary to forge www.paypal.com. If I spun up a stupid fake cert for www.paypal.com last week, with no knowledge of Superfish whatsoever, someone from a Lenovo computer would not get certificate warnings. The more people look at this, the worse it gets. It's a fractal of bad security.