4

From my understanding you are essentially asking if a web server certificate can be setup in a way that the traffic cannot be transparently intercepted and decrypted by corporate MITM solution, which a new root CA is installed as trusted at the client. I.e. the question is not specific to VPN. In a MITM setup the MITM proxy is basically the client to the ...


3

From the article: The website must use “clear text” which means the URL starts with “http” not “https.” The technique described in the article sounds hardly different from a man in the middle (MitM) attack, at least in terms of the potential impact. Just like in a MitM scenario where an attacker can read and modify all data on the wire, TLS (therefore ...


1

Remember than the characters in those "Alice and Bob" stories aren't people, they are computers. And all the things they are doing in those stories is done automatically by software. It isn't difficult for the software running on Eve to encode a new image file with the text representation of a different public key. There are software libraries for ...


1

Bob and Alice should use a separate, secure channel to exchange their keys. A photo sent over the same insecure channel doesn't provide that. We can't say how likely anything is, but as with all security through obscurity, assume the worst. The authenticity of the key is as trustworthy as the channel used to transmit it. The secure channel for changing the ...


1

Alice wants to send the same public key twice, and Bob has to manually check that they match? Not sure about the practicality of this. If this was a regular thing, and I was Bob, I'd put the photo through an OCR* script to automatically do the checking. And if I was the hacker I'd write a script to automatically alter the public key and generate a ...


1

The purpose of HTTP interception proxies is not to MitM requests of another user, and does not represent such attacks like you have stated. Instead, the purpose is to modify/craft requests in different ways in order to search for vulnerabilities in the way the backend handles requests. Example: You are testing a website's form field for SQL injection or XSS. ...


Only top voted, non community-wiki answers of a minimum length are eligible