Hot answers tagged

67 votes
Accepted

What legitimate uses do browser proxies have?

One of the early uses of HTTP proxies was caching proxies in order to make better use of the expensive bandwidth and to speed up surfing by caching heavily used content near the user. I remember a ...
user avatar
65 votes
Accepted

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

Having a proxy SSL certificate creates some privacy and security implications: Superfish can impersonate any site This does not mean that Superfish will do it (or is doing), but they have the power. ...
user avatar
  • 50.5k
47 votes
Accepted

Why hasn't anyone taken over Tor yet?

They might do it already, there is a known technique to dedicate malicious and powerful nodes to the network to be able to take control of some of the traffic. Tor does not advertise itself to be able ...
user avatar
  • 3,369
43 votes

What benefits are there to blocking most search engines?

In many jurisdictions, school districts are legally required to have web filtering in place. Google & Bing are two examples of companies who's "Safe Search" API has been around and stable for ...
user avatar
  • 745
41 votes
Accepted

Security Headers for a web API

Checking headers off a list is not the best technique to assert a site's security. Services like securityheaders.io can point you in the right direction but all they do is compare against a list of ...
user avatar
  • 43.6k
33 votes

How is it possible to do TLS through proxy without anyone noticing?

Normally, when HTTPS is done through a proxy, this is done with the CONNECT mechanism: the client talks to the proxy and asks it to provide a bidirectional tunnel for bytes with the target system. In ...
user avatar
  • 168k
22 votes

How do I know if my company or my ISP is using a TLS proxy?

How to know if your company does TLS intercept As the post you linked to explains, the proxy will decrypt all the traffic, and then encrypt it again but signed with another certificate. Therefore the ...
user avatar
  • 64.2k
19 votes
Accepted

How does a website detect proxy?

A proxy will by default tell the destination the IP address of the original requester by adding a X-Forwarded-For HTTP header to the original HTTP request. This make it obviously easy for the server, ...
user avatar
18 votes

Does an HTTPS proxy encrypt traffic between proxy client and server for HTTP requests?

It may be simpler to see it in stages. First, in a whole-HTTP world (no SSL whatsoever), an HTTP request is a collection of headers, indicating the target URL, and sent over a TCP connection (usually ...
user avatar
  • 168k
18 votes
Accepted

Nmap through proxy

TL;DR: proxy support is limited right now but there are also theoretical limits of what you could do when using a proxy. nmap can do only CONNECT and SOCKS4 and these protocols can do only TCP. ...
user avatar
18 votes

Is systemd's hand-rolled Desktop-Bus-over-SSH tunnel a security worry?

Discussing this on Twitter is the modern day equivalent of Fermat discussing mathematical proofs via marginalia. So let us expand upon what Peter Wullinger did not have the space to fit into a margin ...
user avatar
  • 681
15 votes

What legitimate uses do browser proxies have?

Some examples as follows: To enable a firewall rule like 'proxy server to any destination on 80, 443' instead of from 'any internal to any external' To monitor all websites visited through logs To ...
user avatar
  • 3,129
14 votes

Are future TLS versions going to prevent traffic inspection?

TLS by itself protects the sniffing and modification of traffic between two endpoints, i.e. client and server. TLS interception just makes two TLS connections where only one was, i.e. client to ...
user avatar
13 votes
Accepted

Securing remotely accessible IP cameras that do not support HTTPS

I'm going to assume your router isn't smart enough to set up an encrypted reverse proxy by itself. Conventions Used Below Home IP Address: 1.2.3.4 ( google search my ip to find yours ) WebCam IP ...
user avatar
  • 38.6k
13 votes
Accepted

How trustable are third party root certificates?

It's safe as long as you understand the implications. Fiddler acts as a proxy / man in the middle to intercept and decrypt traffic between you and the target. For SSL sites, it does this by ...
user avatar
  • 3,913
13 votes
Accepted

How is it possible to do TLS through proxy without anyone noticing?

Since version 1.1, HTTP supports a special method, CONNECT. This sets up the TLS tunnel through the proxy, even though your computer only directly connects to the proxy. HTTPS knows how to tunnel the ...
user avatar
  • 71.8k
12 votes

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

Here are a few risks that you expose yourself to with this specific software: It uses the same private key for each installation. Since the associated is a root CA and is inserted into your private ...
user avatar
  • 18.5k
12 votes
Accepted

Are future TLS versions going to prevent traffic inspection?

No. AFAIK there is nothing inside the TLS 1.3 Draft about that. And I don't think there's a technical solution to this either. If you allow somebody to install an additional root CA on your computer, ...
user avatar
12 votes
Accepted

Why are HTTPS requests blocked by Firefox when using ZAP proxy?

ZAP creates certificates, on the fly, in the name of the site Firefox is going to. Firefox is saying "I don't trust the CA that signed this cert", which is reasonable, because it's a MITM by an ...
user avatar
  • 71.3k
12 votes
Accepted

Why/how does Firefox bypass my employer's SSL decryption?

It's quite simple really, it's your employer that hasn't secured their network properly. I guess that they add a system proxy settings or they configured the other browsers to use their interception ...
user avatar
  • 31k
12 votes

What legitimate uses do browser proxies have?

For the "original" reason, think back to 1993, when Netscape 0.9 was released. It had a "Mail and Proxies" Options dialog (per a copy of the manual). At that time, most Internet links were 56-kbit or ...
user avatar
  • 711
10 votes

HTTPS login vs MITM attack

You are correct. Some ways for the site to decrease that attack vector would be to... Use an HSTS header to prevent any data from being sent to the site in plaintext. Advertise only the HTTPS URL ...
user avatar
  • 5,454
10 votes

How trustable are third party root certificates?

The way that I understand that Fiddler (And similar proxyies such as Burp or OWASP ZAP) work is that each installation generates a unique root certificate which it then uses to generate certificates ...
user avatar
  • 60.6k
10 votes

How to send HTTPrequest anonymously

There's a number of ways that you could achieve this As @raz says in comments use Tor. The Tor network is designed to anonymise Internet traffic so this would fit your bill quite well. Using ...
user avatar
  • 60.6k
10 votes

What legitimate uses do browser proxies have?

Yes, they're frequently used in the corporate world. Perhaps less so now than in the past, but years ago they were commonly the only gateway from a local network to the Internet. In many cases only ...
user avatar
  • 35.4k
9 votes

Difference between X-Forwarded-For IP, X-Real-IP, VPNs and TOR

X-Forwarded-For header may be used to forward client's real IP in case of source NAT. But not all application use them. This header is often inserted by load-balancers or reverse-proxies, depending ...
user avatar
9 votes
Accepted

Why don't despotic countries simply block all encrypted traffic?

Because HTTPS underpins a lot of websites. Anywhere you authenticate, you should be using HTTPS. So that's things like: banking social media government sites like tax submission anything with an ...
user avatar
  • 4,737
9 votes
Accepted

httpoxy - does TLS/SSL mitigate the vulnerability of HTTP Proxy header?

I did not know about this until I read the link you posted, so do not view this answer as authorative. I would recommend you to take the precautions listed under "Immediate Mitigation" now, ...
user avatar
  • 64.2k
9 votes

Difference between socks5 and socks4 proxy?

From wikipedia: The SOCKS5 protocol is defined in RFC 1928. It is an extension of the SOCKS4 protocol; it offers more choices for authentication and adds support for IPv6 and UDP, the latter of ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible