0

I am trying to understand the extent to which SSL certificates secure the content (or activities) over SSL. Here is my understanding:

Under a hypothetical condition:

  1. Person-A is the Administrator of a windows laptop.
  2. Person-B is a non-admin user of that laptop.

My understanding:

When person-B visits a CA-Signed SSL certified site (https://example.com), the activities (Eg: writing a comment, etc) done within the site are hidden (encrypted) from everyone including Person-A (admin), however, Person-A may see the domains Person-B visited.

If the above is true, is it also applicable when Person-B visits a site with a self-signed certificate if person-B trusts the self-sign certificate?

Improve this question
5
  • Is person A also using the laptop at the same time?
    – schroeder ♦
    Commented Mar 1, 2022 at 16:59
  • Assuming, not using the same time.
    – monk
    Commented Mar 1, 2022 at 17:00
  • 1
    so ... how would the admin see the content of person b's activity even if TLS wasn't used at all?
    – schroeder ♦
    Commented Mar 1, 2022 at 17:01
  • your counter-question makes sense. I was mainly concerned about SSL/TLS encrypted content visibility to privileged users via some snooping tools like tcpdump, browser extensions, post-analysis via logs etc. what if used at the same time?
    – monk
    Commented Mar 1, 2022 at 17:06
  • Also, I am sorry as I am still figuring out things. so my question itself IS not clear
    – monk
    Commented Mar 1, 2022 at 17:07

1 Answer 1

Reset to default
4

A privileged user is able to install some software doing network interception and also add a new trusted root CA. This together makes it possible to do an active MITM attack on the TLS traffic, and thus listen and even modify the traffic. This is similar to what many antivirus products do.

Improve this answer
1
  • Another solution is for the admin to hook into the targeted programs (eg. using a debugger) in order to extract the TLS connections secrets (master secrets, etc.) and use these to decrypt the traffic without an active MITM.
    – ysdx
    Commented Mar 3, 2022 at 21:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .