In situations where the consumer doesn't trust/control the workstation and the network, can consumer safely do potentially sensitive activities (like making a payment or transferring confidential documents) over the internet when HTTPS is used?
For instance: when I use my employer's computer and am on the company network, or I am in an airport and use a public kiosk there there.
Naturally, IT administrators in these circumstances are in full control of CA management, and could potentially use a proxy and load the proxy's certificate into the trusted root list, so my browser would show everything being fine.
My current understanding is that as long as I can verify that the cert isn't spoofed and is signed by a well known CA, I can be assured that there's no one eavesdropping on the traffic.
Now if my previous statement is correct what is the best way to verify that cert? I understand that I can just open it up and inspect the CA's name, but are there any extra steps I can take? For instance, could I somehow export the cert I'm receiving from the HTTPS site and submit it to some service for verification?