4 Minor typo/grammar fixes.
source | link

Having a proxy SSL certificate creates some privacy and security implications:

  • Superfish can impersonate any site

    This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted.

    Certificate pinning does not protect you, either:

    "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues."

    If you use Windows and EMET, Certificate Trust can protect you IF you configure it beforehand. But the process is manual and somewhat complicated.

  • Superfish can intercept traffic

    As a trusted CA, Superfish can perform a MiTM attack on any site, and the average user will not detect the attack. Savvy users can see that the certificate was signed by a strange CA, if they know where to look.

  • Superfish can inject code anywhere

    Even if the site is protected by SSL/TLS, Superfish can inject Javascript or HTML on every page. They just proxy the requests, make the request to the intended server, read the response, inject data, and send data to the user. And unless you are looking tofor it, you will never notice.

  • Superfish can be used to install malware

    Like above, Superfish can add code to Windows updates, alter executables being downloaded, infect Java applets, Flash files and so on. Any download could be silently comprimisedcompromised. They could even change the origin site and put changed checksums on it, so even if you calculate the hash after downloading the files, they would look legit.

  • Superfish can know every site you access

    The software monitors your browser and send data to Superfish. Even without the software, they can inject code on every site and track you everywhere.

  • Anyone on the web can use its certificate

    The private key of the certificate has been compromised, so anyone knowing the key can use Superfish certificate to create valid SSL certificates for anything they want.

Saying that they can does not mean or imply that they will, only that they have the power to do if they want (or are forced to).

Having a proxy SSL certificate creates some privacy and security implications:

  • Superfish can impersonate any site

    This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted.

    Certificate pinning does not protect you, either:

    "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues."

    If you use Windows and EMET, Certificate Trust can protect you IF you configure it beforehand. But the process is manual and somewhat complicated.

  • Superfish can intercept traffic

    As a trusted CA, Superfish can perform a MiTM attack on any site, and the average user will not detect the attack. Savvy users can see that the certificate was signed by a strange CA, if they know where to look.

  • Superfish can inject code anywhere

    Even if the site is protected by SSL/TLS, Superfish can inject Javascript or HTML on every page. They just proxy the requests, make the request to the intended server, read the response, inject data, and send data to the user. And unless you are looking to it, you will never notice.

  • Superfish can be used to install malware

    Like above, Superfish can add code to Windows updates, alter executables being downloaded, infect Java applets, Flash files and so. Any download could be silently comprimised. They could even change the origin site and put changed checksums on it, so even if you calculate the hash after downloading the files, they would look legit.

  • Superfish can know every site you access

    The software monitors your browser and send data to Superfish. Even without the software, they can inject code on every site and track you everywhere.

  • Anyone on the web can use its certificate

    The private key of the certificate has been compromised, so anyone knowing the key can use Superfish certificate to create valid SSL certificates for anything they want.

Saying that they can does not mean or imply that they will, only that they have the power to do if they want (or are forced to).

Having a proxy SSL certificate creates some privacy and security implications:

  • Superfish can impersonate any site

    This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted.

    Certificate pinning does not protect you, either:

    "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues."

    If you use Windows and EMET, Certificate Trust can protect you IF you configure it beforehand. But the process is manual and somewhat complicated.

  • Superfish can intercept traffic

    As a trusted CA, Superfish can perform a MiTM attack on any site, and the average user will not detect the attack. Savvy users can see that the certificate was signed by a strange CA, if they know where to look.

  • Superfish can inject code anywhere

    Even if the site is protected by SSL/TLS, Superfish can inject Javascript or HTML on every page. They just proxy the requests, make the request to the intended server, read the response, inject data, and send data to the user. And unless you are looking for it, you will never notice.

  • Superfish can be used to install malware

    Like above, Superfish can add code to Windows updates, alter executables being downloaded, infect Java applets, Flash files and so on. Any download could be silently compromised. They could even change the origin site and put changed checksums on it, so even if you calculate the hash after downloading the files, they would look legit.

  • Superfish can know every site you access

    The software monitors your browser and send data to Superfish. Even without the software, they can inject code on every site and track you everywhere.

  • Anyone on the web can use its certificate

    The private key of the certificate has been compromised, so anyone knowing the key can use Superfish certificate to create valid SSL certificates for anything they want.

Saying that they can does not mean or imply that they will, only that they have the power to do if they want (or are forced to).

3 added 259 characters in body
source | link

Having a proxy SSL certificate creates some privacy and security implications:

  • Superfish can impersonate any site

    This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted.

    Certificate pinning does not protect you, either:

    "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues."

    If you use Windows and EMET, Certificate Trust can protect you IF you configure it beforehand. But the process is manual and somewhat complicated.

  • Superfish can intercept traffic

    As a trusted CA, Superfish can perform a MiTM attack on any site, and the average user will not detect the attack. Savvy users can see that the certificate was signed by a strange CA, if they know where to look.

  • Superfish can inject code anywhere

    Even if the site is protected by SSL/TLS, Superfish can inject Javascript or HTML on every page. They just proxy the requests, make the request to the intended server, read the response, inject data, and send data to the user. And unless you are looking to it, you will never notice.

  • Superfish can be used to install malware

    Like above, Superfish can add code to Windows updates, alter executables being downloaded, infect Java applets, Flash files and so. Any download could be silently comprimised. They could even change the origin site and put changed checksums on it, so even if you calculate the hash after downloading the files, they would look legit.

  • Superfish can know every site you access

    The software monitors your browser and send data to Superfish. Even without the software, they can inject code on every site and track you everywhere.

  • Anyone on the web can use its certificate

    The private key of the certificate has been compromised, so anyone knowing the key can use Superfish certificate to create valid SSL certificates for anything they want.

Saying that they can does not mean or imply that they will, only that they have the power to do if they want (or are forced to).

Having a proxy SSL certificate creates some privacy and security implications:

  • Superfish can impersonate any site

    This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted.

    Certificate pinning does not protect you, either:

    "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues."

  • Superfish can intercept traffic

    As a trusted CA, Superfish can perform a MiTM attack on any site, and the average user will not detect the attack. Savvy users can see that the certificate was signed by a strange CA, if they know where to look.

  • Superfish can inject code anywhere

    Even if the site is protected by SSL/TLS, Superfish can inject Javascript or HTML on every page. They just proxy the requests, make the request to the intended server, read the response, inject data, and send data to the user. And unless you are looking to it, you will never notice.

  • Superfish can be used to install malware

    Like above, Superfish can add code to Windows updates, alter executables being downloaded, infect Java applets, Flash files and so. Any download could be silently comprimised. They could even change the origin site and put changed checksums on it, so even if you calculate the hash after downloading the files, they would look legit.

  • Superfish can know every site you access

    The software monitors your browser and send data to Superfish. Even without the software, they can inject code on every site and track you everywhere.

  • Anyone on the web can use its certificate

    The private key of the certificate has been compromised, so anyone knowing the key can use Superfish certificate to create valid SSL certificates for anything they want.

Saying that they can does not mean or imply that they will, only that they have the power to do if they want (or are forced to).

Having a proxy SSL certificate creates some privacy and security implications:

  • Superfish can impersonate any site

    This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted.

    Certificate pinning does not protect you, either:

    "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues."

    If you use Windows and EMET, Certificate Trust can protect you IF you configure it beforehand. But the process is manual and somewhat complicated.

  • Superfish can intercept traffic

    As a trusted CA, Superfish can perform a MiTM attack on any site, and the average user will not detect the attack. Savvy users can see that the certificate was signed by a strange CA, if they know where to look.

  • Superfish can inject code anywhere

    Even if the site is protected by SSL/TLS, Superfish can inject Javascript or HTML on every page. They just proxy the requests, make the request to the intended server, read the response, inject data, and send data to the user. And unless you are looking to it, you will never notice.

  • Superfish can be used to install malware

    Like above, Superfish can add code to Windows updates, alter executables being downloaded, infect Java applets, Flash files and so. Any download could be silently comprimised. They could even change the origin site and put changed checksums on it, so even if you calculate the hash after downloading the files, they would look legit.

  • Superfish can know every site you access

    The software monitors your browser and send data to Superfish. Even without the software, they can inject code on every site and track you everywhere.

  • Anyone on the web can use its certificate

    The private key of the certificate has been compromised, so anyone knowing the key can use Superfish certificate to create valid SSL certificates for anything they want.

Saying that they can does not mean or imply that they will, only that they have the power to do if they want (or are forced to).

2 Added info on certificate comprimise
source | link

Having a proxy SSL certificate creates some privacy and security implications:

  • Superfish can impersonate any site

    This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted.

    Certificate pinning does not protect you, either:

    "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues."

  • Superfish can intercept traffic

    As a trusted CA, Superfish can perform a MiTM attack on any site, and the average user will not detect the attack. Savvy users can see that the certificate was signed by a strange CA, if they know where to look.

  • Superfish can inject code anywhere

    Even if the site is protected by SSL/TLS, Superfish can inject Javascript or HTML on every page. They just proxy the requests, make the request to the intended server, read the response, inject data, and send data to the user. And unless you are looking to it, you will never notice.

  • Superfish can be used to install malware

    Like above, Superfish can add code to Windows updates, alter executables being downloaded, infect Java applets, Flash files and so. Any download could be silently comprimised. They could even change the origin site and put changed checksums on it, so even if you calculate the hash after downloading the files, they would look legit.

  • Superfish can know every site you access

    The software monitors your browser and send data to Superfish. Even without the software, they can inject code on every site and track you everywhere.

  • Anyone on the web can use its certificate

    The private key of the certificate has been compromised, so anyone knowing the key can use Superfish certificate to create valid SSL certificates for anything they want.

Saying that they can does not mean or imply that they will, only that they have the power to do if they want (or are forced to).

Having a proxy SSL certificate creates some privacy and security implications:

  • Superfish can impersonate any site

    This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted.

  • Superfish can intercept traffic

    As a trusted CA, Superfish can perform a MiTM attack on any site, and the average user will not detect the attack. Savvy users can see that the certificate was signed by a strange CA, if they know where to look.

  • Superfish can inject code anywhere

    Even if the site is protected by SSL/TLS, Superfish can inject Javascript or HTML on every page. They just proxy the requests, make the request to the intended server, read the response, inject data, and send data to the user. And unless you are looking to it, you will never notice.

  • Superfish can be used to install malware

    Like above, Superfish can add code to Windows updates, alter executables being downloaded, infect Java applets, Flash files and so. Any download could be silently comprimised. They could even change the origin site and put changed checksums on it, so even if you calculate the hash after downloading the files, they would look legit.

  • Superfish can know every site you access

    The software monitors your browser and send data to Superfish. Even without the software, they can inject code on every site and track you everywhere.

Saying that they can does not mean or imply that they will, only that they have the power to do if they want (or are forced to).

Having a proxy SSL certificate creates some privacy and security implications:

  • Superfish can impersonate any site

    This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted.

    Certificate pinning does not protect you, either:

    "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues."

  • Superfish can intercept traffic

    As a trusted CA, Superfish can perform a MiTM attack on any site, and the average user will not detect the attack. Savvy users can see that the certificate was signed by a strange CA, if they know where to look.

  • Superfish can inject code anywhere

    Even if the site is protected by SSL/TLS, Superfish can inject Javascript or HTML on every page. They just proxy the requests, make the request to the intended server, read the response, inject data, and send data to the user. And unless you are looking to it, you will never notice.

  • Superfish can be used to install malware

    Like above, Superfish can add code to Windows updates, alter executables being downloaded, infect Java applets, Flash files and so. Any download could be silently comprimised. They could even change the origin site and put changed checksums on it, so even if you calculate the hash after downloading the files, they would look legit.

  • Superfish can know every site you access

    The software monitors your browser and send data to Superfish. Even without the software, they can inject code on every site and track you everywhere.

  • Anyone on the web can use its certificate

    The private key of the certificate has been compromised, so anyone knowing the key can use Superfish certificate to create valid SSL certificates for anything they want.

Saying that they can does not mean or imply that they will, only that they have the power to do if they want (or are forced to).

1
source | link