Timeline for Is it common practice for companies to MITM HTTPS traffic?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 9, 2015 at 23:58 | comment | added | Coxy | @TOOGAM it doesn't sound like a capital P Policy to me but I guess that would be up to the OP to determine. | |
| Dec 9, 2015 at 19:09 | comment | added | kojiro | this MITM may be hurting security in an area that the organization doesn't care about. Maybe, but teaching employees to bypass certificate warnings can only be something the company doesn't care about out of willful ignorance. | |
| Dec 9, 2015 at 13:06 | comment | added | TOOGAM | @Coxy : That violates the question's first sentence : "a new VPN policy whereby once connected all traffic is routed the company network." Such a workaround would technically function, but be a policy violation. Better to fix a broken policy than to break it. | |
| Dec 9, 2015 at 13:06 | comment | added | TOOGAM | @NathanGoings : Whether privacy on employer equipment is a sensible expectation could depend on an End User agreement. If I am to trust a computer, I want it to have no unannounced keyloggers or other malicious designs such as breaking the HTTPS protocol by violating the chain of trust. Institutions should find ways to avoid fines other than lying, such as using technology to falsify a technical identity. (If legitimate HTTPS is unfeasible due to security concerns, I'd rather HTTPS be honestly blocked than having a dishonest service mimics the valid service of relaying HTTPS data.) | |
| Dec 9, 2015 at 7:52 | comment | added | Coxy | Another option might be to setup a route so that internet browsing does not go through the VPN at all, thereby allowing you to remain connected for email/file/other access but still get the benefit of faster and non-MITM communications otherwise. | |
| Dec 9, 2015 at 4:15 | comment | added | Nathan Goings | Employees should never expect privacy when utilizing employer equipment. Furthermore, when dealing with sensitive information such as healthcare -- institutions are more worried about huge fines. | |
| Dec 8, 2015 at 15:34 | review | First posts | |||
| Dec 8, 2015 at 15:46 | |||||
| Dec 8, 2015 at 15:33 | history | answered | TOOGAM | CC BY-SA 3.0 |