I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate.
I've got a very precise question but first I need to give some background.
Basically I'm very surprised by the recent development that highlighted the fact that both Nokia and Opera Mini are actually using their servers as endpoint of "secure" SSL connection between users and websites (like for example online banking websites).
Apparently they're doing so in the name of performance: they're using their servers as the endpoint which then act as a proxy for the user. On their servers, they are rendering and compressing the page to be displayed and sending that to their users.
I'm also totally confused by the reaction of most people: most people reacting say: "Nothing to see here, it's common practice, move along".
It comes as a shock as I was under the impression that I was the endpoint, not some Nokia / Opera Mini server. I realize that it's not a MITM attack over SSL because the servers become the endpoint and, you, the user, are served "something else" (either modified HTML or a picture or whatever)...
I understand it's (supposedly) done in the name of performance. I personally see it as sacrifying security in the name of performance but whatever.
Now, and that's where the real shock comes for me, several people pointed out that it's not only phone makers who could do this, but any ISP as well.
And I found this sentence:
"Software that does use the OS cert store or SSL lib should still be immune to this"
So my question is very simple: how can I securely connect, from a desktop computer (not from a phone), to websites using HTTPS (like my online banking website or my GMail), knowing that I may be using an ISP interested in spying on me?
Does a browser like Google Chrome, for example, have any protection against this? (for example is it sufficient to look at the green "lock" icon followed by "HTTPS://mail.google.com/..." or can this be tricked too by the ISP?)
both Nokia and Opera Mini are actually using their servers as endpoint of "secure" SSL connection between users and websites (like for example online banking websites).?