0

I know that even with HTTPS it's possible to a company proxy to see traffic from/to my website (e.g. Intercepting HTTPS Traffic Using the Squid Proxy Service in pfSense).

I want my users to have total privacy. Is there a way to secure the data, maybe using Javascript, or a second layer of SSL, etc.? Is there an open solution elsewhere?

1
  • 1
    I want my users to have total privacy Give up now. ... Improving is good and possible, but perfect security of anything in real life will never work.
    – user155462
    Mar 28, 2018 at 10:19

2 Answers 2

1

Client browsing your web site will receive a certificate warning if the connection is going through a proxy unless the MITM server uses a CA that the client trusts as well for the connection so there is no real vulnerability as long as your users maintain their own security.

Alternatively, you can require TLS client certificate authentication on the server. You will then have to manage the secure distribution of the client certificate you accept but as long as this part of the setup holds, it won't be possible to perform a MITM attack on the connection.

-2

If you are an admin use HSTS There are some measures that you can take for data privacy 1.Use TOR 2.Use a vpn If you combine both of these, you will be 99% anonymous.

4
  • 2
    HSTS will not help you against a TLS intercepting proxy. As for a VPN, I interpret the question as being from the website owners perspective, and not the users. So a VPN isn't really an option.
    – Anders
    Mar 28, 2018 at 11:17
  • Perhaps you mean HPKP? It can be dangerous though if you misconfigure or end up losing the key. Mar 28, 2018 at 13:31
  • 1
    @AndrolGenhald: HPKP will not help against SSL interception either. If the CA of the intercepting proxy is explicitly trusted by the client any pinning will be ignored by the browsers. Mar 28, 2018 at 15:42
  • @SteffenUllrich Good point, keep forgetting about that. Mar 28, 2018 at 15:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .