3

While reading about Family Safety and HTTPS:

Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is essentially a man-in-the-middle attack.

To consent to such snooping, and suppress all "Untrusted Certificate" warnings arising from this scheme, you need to instruct Firefox to trust Microsoft's SSL certificate that is used for re-encrypting.

the following questions arised:

I asked myself whether Microsoft Family Safety would be a security risk. If I make a connection to https://google.com on a Family Safety-enabled computer, and the google certificate is borked (because someone is dropping in with invalid cert, or because google forgot to renew it), will I be notified? Or will I only see that the connection to Family Safety is good?

So wouldn't online banking from a Family Safety-enabled account be a big security risk? (I didn't see this mentioned in the Microsoft advertisements)

Furthermore, to re-encrypt, Family Safety would need to have the private key for the cert on my personal computer, and on six billion other personal computers, and IE trusts that cert. So a malicious user could use this private key and his servers would be certified Microsoft servers and trusted by IE by default. Correct?

  • 2
    You can try to connect to some deliberately wrongly configured HTTPS sites listed in the "test center" on this page, e.g. tv.eurosport.com, with family safety enabled. – user10008 Dec 19 '14 at 7:39
3

I played around with Family Safety on Windows 8.1, and from what I can tell, it's seems to be smart enough to check the validity of the original certificate before it proceeds to replace it with a Microsoft certificate.

From the screenshot below, you can tell that when I visited Google, Google's real certificate was replaced by the Microsoft Family Safety certificate:

enter image description here

However, if I visit a site with an invalid certificate, it still presents a warning: enter image description here

So it is pretty clear that if the certificate check fails, Family Safety will NOT replace the certificate and will instead allow the warning to be shown. I tested this in both Internet Explorer and Google Chrome and both display the same behavior.

Furthermore, to re-encrypt, Family Safety would need to have the private key for the cert on my personal computer, and on six billion other personal computers, and IE trusts that cert. So a malicious user could use this private key and his servers would be certified Microsoft servers and trusted by IE by default. Correct?

The family safety certificate isn't being used for website verification, so there's no need to install the same one on every computer in the world. I'd imagine that it is randomly generated and added as trusted when you enable Family Safety (or at least when the computer is installed). Theoretically if someone steals the key for the certificate on YOUR particular computer, the might be able to man-in-the-middle YOU without generating warnings, but no one else.

0

Another point here to note is that as family safety uses windows filtering platform, it intercepts packets and examines them, an SSL/TLS connection request contains the server name in clear text, so for examplee (as above) "revoked.grc.com" will be visible to any snooping but the remainder of the request will not be.

  • 1
    Hello and welcome to Information Security. I think this works better as a comment, not an answer. You could answer other questions until you earn "commenting" privileges. – Jedi Jul 7 '16 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.