0

Can websites, server-side apps such as those that rely on a constant connection with server e.g. messaging apps, server-side online games such as those that rely on constant server connection for player movement, inventory data etc. tell that I used MitM on my own computer (client) to view their HTTPS traffic and then re-encrypt it and send it to their servers?

And what if I don't just decrypt-view-re-encrypt it, what if I modify it too, can they detect it? a subtle modification, i.e. a modification in the data that falls in their acceptable range of expected data.

Improve this question
0

1 Answer 1

Reset to default
0

Can websites, apps, games etc. tell that I used MitM on my own computer to view their HTTPS traffic and then re-encrypt it and send it to their servers?

Server applications do not distinguish clients. MitM is no different from server application perspective than legitimate client.

Only client can detect (under certain circumstances) that its traffic with server is listened by someone else. If MitM is not legit, an application will present error messages that server certificate (which is actually MitM cert) is not valid/trusted. This is an indication that someone attempts to listen the traffic.

In enterprises, it is hard to detect when company implements a HTTPS inspection on their gateways, because company has control over all enterprise applications/devices and can install CA cert used by HTTPS inspector into trust store. In this case, MitM will be transparent and undetectable.

As the last resort, client applications may implement HTTP Public Key Pinning which will detect the most sophisticated MitM scenarios, however this approach is not very popular because of expensive maintenance and additional implementation in the app code.

Improve this answer
2
  • Thank you for the answer btw, I modified my question a bit to reflect what I actually meant, please take a look. and what do you mean by MitM is not legit? is there any legit MitM? how do they become legit? the certificate authority companies who vet applicants that want to buy their certificate for their website/app/company can give legit certificate to MitM actors and that makes them legit MitM? and lastly, fiddler MitM isn't legit, is it?
    – user279925
    Commented Jul 7, 2022 at 11:28
  • is there any legit MitM? -- in enterprises can. That is, company informs you about the fact that your HTTPS traffic is listened for security purposes and implement MitM on their gateway. Legit term here means legally legit, i.e. user is acknowledged and agreed that their traffic is sniffed.
    – Crypt32
    Commented Jul 7, 2022 at 12:13