1

I am connecting to a HTTPS service with SSL through a HTTP (not HTTPS) proxy.

I am using Chrome/Firefox proxy settings. (Chrome does not directly expose them, but it can be set via chrome extension or by command line argument. Firefox exposes that in settings.)

I keep wondering, what can "evil" HTTP proxy do? What does it see?

When I connect to HTTPS web server, can evil HTTP proxy:

  • see the requests
  • read the requests
  • change the requests maliciously to something else?

How would that differ, if I used HTTPS proxy? How would that differ, if I used SOCKS proxy?

Basically, I am not sure which one of these 2 mental models are true.

two models

1 Answer 1

1

If the proxy is NOT an SSL intercepting proxy then the proxy can only see the target hostname and make observations about the encrypted traffic, i.e. size, timing and direction of data but not the application data itself.

An untrusted SSL intercepting proxy can also decrypt the traffic - but in this case the client would get a certificate warning or the browser would reject the connection outright. With a trusted intercepting proxy though (like in corporate environments) the browser does not throw any warnings since the proxies certificates are trusted.

4
  • How to tell which one it is? I can see the proxy can add its own headers to the HTTP request. (X-Forwarded-For, Via.) So how come it cannot do anything else? Apr 1, 2022 at 5:42
  • @KarelBílek: if the proxy can add a header then it must be able to decrypt the content. Apr 1, 2022 at 8:37
  • I thought so too. But then, Google Chrome and Ffx all show the green SSL logo, as if all is being encrypted? So I am utterly confused what is even happening. Apr 4, 2022 at 7:26
  • @KarelBílek: see for example security.stackexchange.com/questions/133254/… Apr 4, 2022 at 7:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .