0

I know that even with HTTPS it's possible to a company proxy to see traffic from/to my website (e.g. Intercepting HTTPS Traffic Using the Squid Proxy Service in pfSense).

I want my users to have total privacy. Is there a way to secure the data, maybe using Javascript, or a second layer of SSL, etc.? Is there an open solution elsewhere?

  • 1
    I want my users to have total privacy Give up now. ... Improving is good and possible, but perfect security of anything in real life will never work. – user155462 Mar 28 '18 at 10:19
1

Client browsing your web site will receive a certificate warning if the connection is going through a proxy unless the MITM server uses a CA that the client trusts as well for the connection so there is no real vulnerability as long as your users maintain their own security.

Alternatively, you can require TLS client certificate authentication on the server. You will then have to manage the secure distribution of the client certificate you accept but as long as this part of the setup holds, it won't be possible to perform a MITM attack on the connection.

-2

If you are an admin use HSTS There are some measures that you can take for data privacy 1.Use TOR 2.Use a vpn If you combine both of these, you will be 99% anonymous.

  • 2
    HSTS will not help you against a TLS intercepting proxy. As for a VPN, I interpret the question as being from the website owners perspective, and not the users. So a VPN isn't really an option. – Anders Mar 28 '18 at 11:17
  • Perhaps you mean HPKP? It can be dangerous though if you misconfigure or end up losing the key. – AndrolGenhald Mar 28 '18 at 13:31
  • 1
    @AndrolGenhald: HPKP will not help against SSL interception either. If the CA of the intercepting proxy is explicitly trusted by the client any pinning will be ignored by the browsers. – Steffen Ullrich Mar 28 '18 at 15:42
  • @SteffenUllrich Good point, keep forgetting about that. – AndrolGenhald Mar 28 '18 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.