While reading about Family Safety and HTTPS:
Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is essentially a man-in-the-middle attack.
To consent to such snooping, and suppress all "Untrusted Certificate" warnings arising from this scheme, you need to instruct Firefox to trust Microsoft's SSL certificate that is used for re-encrypting.
the following questions arised:
I asked myself whether Microsoft Family Safety would be a security risk. If I make a connection to https://google.com on a Family Safety-enabled computer, and the google certificate is borked (because someone is dropping in with invalid cert, or because google forgot to renew it), will I be notified? Or will I only see that the connection to Family Safety is good?
So wouldn't online banking from a Family Safety-enabled account be a big security risk? (I didn't see this mentioned in the Microsoft advertisements)
Furthermore, to re-encrypt, Family Safety would need to have the private key for the cert on my personal computer, and on six billion other personal computers, and IE trusts that cert. So a malicious user could use this private key and his servers would be certified Microsoft servers and trusted by IE by default. Correct?