0

I just came across the issue about MitM on Opera/Nokia browser 2013. I know, this is an "old" problem, but it seems very interesting to me.

I was wondering how Chrome on mobile handles the SSL certificates and noticed something I didn't expect. There is no possibility to check, which certificate it actually is. Who is the issuer? For whom is it issued?

Wouldn't it be possible, that Google is doing the same thing Nokia did? We just don't know it right? Is it all a question of trust?

I'm not an expert and open for every input. Thanks.

Edit: I see Google is working on it in issue #425158. They maybe aren't doing that, but since Chrome exists for more than 3 years now, it could have been possible.

|improve this question
1

If you believe what Google claims here, SSL traffic is not proxied:

Is my secure traffic optimized by the compression proxy?

No, data compression proxy operates on non-encrypted traffic: HTTPS requests are sent directly from the mobile device to the destination server.

That said, I've not hooked up a debugging proxy to snoop the network traffic, but I suspect they're being forthright.

|improve this answer
  • Thanks, I should have done a little research by myself before asking here. :-) – greenhoorn Apr 17 '15 at 7:14
  • Maybe you would have found it. By c – Neil Smithline Apr 17 '15 at 14:28
  • I just got lucky as I read it earlier this week – Neil Smithline Apr 17 '15 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.