3 ms·
but cant you perform a MITM on SSL anyway?
by ionwake 12y ago
but cant you perform a MITM on SSL anyway?
- leereeves 12y agoIt's possible, but usually prohibitively difficult. (Superfish was scandalous because made MITM attacks easier on affected computers.) TLS and SSL use X.509 certificates[1] to identify who you're talking with. They're cryptographically signed by a Certificate Authority (CA), who must be one of a list of CAs stored on your computer. A MITM attack requires something rather difficult, like breaking the cryptography algorithm, access to the CA's private key, access to install a new CA certificate on your computer, or an insecure CA already on your computer (like Superfish). Edit: As jacques_chester reminded me, it's not difficult for the owner of computer to set up a MITM server, but I don't call that an "attack". 1: http://en.wikipedia.org/wiki/X.509 http://en.wikipedia.org/wiki/X.509
- jacques_chester 12y agoI'm working on a client project right now. Their corporate firewall MITMs all SSL traffic. Their standard OS images all have SSL and root CA certificates installed to make this happen invisibly. The client staff we're working with had no idea this was happening.
- leereeves 12y agoYeah, not many people know about the CA store, and even if you do, and check it, there are so many pre-installed certificates that it's easy to miss a new one. No one at the company had tried to use the network with a computer they bought for themselves?
- jacques_chester 12y agoTheir VPN is very restrictive (no Google, several CDNs are blocked so half the internet is broken) and hard to configure. So they just use the supplied machines. They learnt it from us because we have our own machines.