Timeline for How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?
Current License: CC BY-SA 3.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 27, 2018 at 20:48 | answer | added | juhraffe | timeline score: 1 | |
| Aug 10, 2015 at 0:38 | comment | added | Asclepius | @Iszi, to believe that a corporate root cert would actually be effective at detecting data leakage is credulous; it's a myth that only a tyrannical boss or self-serving "security admin" would perpetrate. Don't believe me? Ask Snowden. There are a hundred ways to leak data. All that the MITMed cert is doing is spying on the little guy's personal activities, and for what. | |
| Oct 13, 2012 at 8:04 | vote | accept | Benoît | ||
| Oct 10, 2012 at 20:12 | answer | added | Mark E. Haase | timeline score: 3 | |
| Jun 20, 2012 at 19:35 | history | tweeted | twitter.com/#!/StackSecurity/status/215528208685219841 | ||
| Jun 20, 2012 at 18:21 | answer | added | Bruno | timeline score: 8 | |
| Jun 20, 2012 at 18:00 | comment | added | Iszi | @Benoît Also, a note: Even if you do configure Firefox, etc. to ignore the proxy's certificate you're still left with the problem of telling good from bad. Unless there's a way to totally bypass the SSL proxy (perhaps a good idea for a separate question) all the certs you get will still be signed by it. | |
| Jun 20, 2012 at 17:50 | comment | added | Iszi | @logicalscope and I have edited your question to hopefully give it a better focus and clarity. Also, FTR: I do not believe your comment is actually removed. If I understand the flagging system correctly, it is only hidden for now until a moderator has an opportunity to review the flag I placed on it for obscenity. I expect that the moderators will review the flag, edit the post to be more appropriate, and then restore the comment. | |
| Jun 20, 2012 at 17:44 | history | edited | Iszi | CC BY-SA 3.0 |
Overhauled for objectivity and clarity.
|
| Jun 20, 2012 at 17:33 | history | edited | logicalscope | CC BY-SA 3.0 |
The actual question, I feel (buried under a rant).
|
| Jun 20, 2012 at 17:32 | comment | added | Iszi | Your client must understand that allowing uninspected HTTPS traffic presents a great opportunity for data leakage or other bypasses of corporate security policy. Without visibility to this traffic, installed malware could hide much of its operations from network-based IDS/IPS in an HTTPS tunnel. Or, a malicious insider could shuffle off company secrets through their HTTPS webmail interface or other SSL-enabled websites or services. Alternately, the insider might choose to use SSL proxies to bypass corporate website filters or other security measures. | |
| Jun 20, 2012 at 17:26 | comment | added | Benoît | (have you removed my comment?) yep, i get that but i'm really puzzled that there's no way for a client to check that the received certificate is genuine. Maybe i should look for a way to manually accept certificate on every first time connection? I wish browser could help me by telling me that the site is now presenting a cert different from the one accepted. And i don't understand the client POV, if they automatically spoof every cert, users can no longer detect fake/phished website and can potentially bring in dangerous content. | |
| Jun 20, 2012 at 17:17 | comment | added | Iszi | @Benoît HTTPS is not "so (screwed) up" as you say - in fact, you've probably already demonstrated that yourself! You can always manually check the chain of any certificate you receive. The browser just gives its green/red light based on the installed list of approved certification authorities. You're under no obligation to use the website just because the browser says the cert is good when you know it's not. If you're worried about the client monitoring your HTTPS traffic, don't use your client's network - bring a cellular hotspot. | |
| Jun 20, 2012 at 17:09 | comment | added | Iszi | I've said it here before, and I'll say it again: If you don't want a company monitoring your personal traffic, don't do personal web browsing on their network. | |
| Jun 20, 2012 at 16:51 | comment | added | curiousguy | "I guess Chrome and IE happily accept the spoofed certificate because" this certificate has been installed in the Windows certificate store by the system administrator. | |
| Jun 20, 2012 at 16:46 | history | asked | Benoît | CC BY-SA 3.0 |