MitM Chrome Mobile

Question

I just came across the issue about MitM on Opera/Nokia browser 2013. I know, this is an "old" problem, but it seems very interesting to me.

I was wondering how Chrome on mobile handles the SSL certificates and noticed something I didn't expect. There is no possibility to check, which certificate it actually is. Who is the issuer? For whom is it issued?

Wouldn't it be possible, that Google is doing the same thing Nokia did? We just don't know it right? Is it all a question of trust?

I'm not an expert and open for every input. Thanks.

Edit: I see Google is working on it in issue #425158. They maybe aren't doing that, but since Chrome exists for more than 3 years now, it could have been possible.

Answer 1

If you believe what Google claims here, SSL traffic is not proxied:

Is my secure traffic optimized by the compression proxy?

No, data compression proxy operates on non-encrypted traffic: HTTPS requests are sent directly from the mobile device to the destination server.

That said, I've not hooked up a debugging proxy to snoop the network traffic, but I suspect they're being forthright.