I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing encrypted traffic.
When I connect to an HTTPS site, my browser gets a certificate for the site which has been signed by the company's proxy - not the real certificate. Chrome and Internet Explorer say the website is secured (everything's green, no warnings) but Firefox says it's not. I know, given the SSL proxy is in place, that it isn't.
I guess that Chrome and IE accept the spoofed certificate because the proxy's certificate is deployed by the GPO. So, when the proxy sends a spoofed certificate (signed by itself) for a website, Chrome and IE show it as valid.
How can someone be expected to browse securely in this environment? With all certificates being signed by the proxy, how can I validate that the website isn't additionally being spoofed by some other third-party? I'm worried that there might come a time where Firefox is also configured to ignore these spoofed certificates. How can I prevent my browsers (Firefox, et. al.) from accepting these certificates?
Why do browsers allow this function? It would seem almost more sensible to completely disable HTTPS than to allow such a false sense of security as this. Is this not a major security issue - that the browser accepts seemingly-legitimate certificates even though they are not the ones provided by the websites?