50

Yes, a company doing SSL interception could in theory read all your traffic if you use the company network. Depending on where you live and what kind of contract you have the ability for the company to do this might also be somehow part of the contract or working rules which might also include that you are only allowed to use the company network for work ...


30

How does the provider forward the traffic without exposing my IP, but also without breaking the SSL. SSL is protection (like encryption) on top of TCP which sits on top of IP. The underlying layers (TCP, IP) can be changed without changing the data transported. This means that the encryption can be kept even though your IP address at the network layer is ...


14

It's ok. The certificate you installed and trusted is used to provide you secure authentication against their RADIUS server and prevent you from connecting to rogue RADIUS server. If someone decides to steal your Active Directory credentials by installing a rogue RADIUS server your phone will pop up with a warning that RADIUS certificate is not trusted. By ...


12

It is not possible to hide the SNI information if the server requires it to serve the proper certificate. There was discussion on encrypting this information in TLS 1.3. But this idea was abandoned since this would require establishing an additional encryption layer and thus adding additional overhead to the connection establishment. Apart from that this ...


10

The short answer is: Your VPN provider can do anything your ISP can do if you're not using a VPN. This may include breaking TLS, if your browser trusts a root CA, which issued an intermediate certificate for middle boxes. You're shifting the trust in not doing so from your ISP to the VPN provider. Most such middle boxes require the users to install a new ...


9

No. A cryptographic system that only protected half of the information would just be slightly better than useless. During the handshake, a symmetric key is exchanged. After the handshake, that symmetric key is used to encrypt all data (usually with AES). So without that symmetric key you are toast - you can not read 50%, you can read 0%. When RSA is used ...


9

In addition to scanning for malware, corporate IT also uses TLS intercept for data loss prevention (DLP), eg. making sure you're not sending proprietary documents through your personal e-mail. In most medium to large companies, you must sign an "Acceptable Use Policy" as a condition of employment, and that policy will explicitly state that they are allowed ...


9

Based on your description and the link you've provided you've likely installed a CA certificate for SSL interception. ... how do I know the certificate I have is legit? That is, actually comes from Google and not from a man in the middle? It does not come from Google. It comes from a man in the middle. It might be a legit man in the middle or not. It is ...


7

Being able to "read" all your encrypted communication doesn't necessarily mean someone is literally sitting at a computer and looking at your data. The "man in the middle" is generally a firewall or proxy appliance, where the IT/Security administrators create rules to block or flag certain types of content. The appliance inspects the packets in plain-text, ...


7

This is not a strictly a legal or technical question, but rather an opinion question - "is it acceptable?" Is it acceptable to you? You bring up a perfectly reasonable technical point though - in that a root cert in your system store allows the controller of that cert to potentially impersonate and intercept any of your SSL/TLS traffic via MitM techniques. ...


6

Anyone can compromise the DNS request authority chain (true). Not true on a global scale but true inside a network you kind of control. This might be a network with weak security (i.e. typical free hotspots). Or it might be a network where you own the router or similar. There are countries where this kind of control is done on a state wide scale. Anyone ...


6

BurpSuite will not intercept server responses by default and display them to you. To enable this functionality go to: Proxy -> Options -> Intercept Server Responses And make sure to check the box next to Intercept responses based on the following rules Then either select one of the displayed rules or add one like the highlighted one below: Also make ...


6

Being able to intercept SSL traffic with an imported root certificate is not considered a weakness of the web application. It's a browser design decision to allow the import of custom local trust anchors. Does implementing the HSTS solving the problem I have? No. A HTTP Strict Transport Security header just enforces HTTPS. HSTS doesn't care which ...


6

What are the possible ways they can do that? The main ways police can obtain search records are by: Looking at local browser history on the suspect's computer (as you mentioned). Demanding connection logs from the ISP, revealing what sites have been visited. Demanding connection records from the sites that you have visited. Demanding search records from ...


6

TL;DR: No. That's not how certificates or pinning work. All certificate pinning does is limit the root of the trust chain to a smaller set, for a specific domain. It doesn't change how the certificates work. It only adds a new constraint on acceptable roots, without disabling any others, and they all have to match -- domain name, date, etc., and now pinned ...


6

Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL inspection, unless the administrator specifically exempts them Yes,You are right the apps that use certificate pinning wont work in an MITM situation.They didnt work when i tried so i think its a fair assumption to make that they wont ...


5

Did you go through these procedures to get JustTrustMe to bypass the cert pinning -- http://www.welivesecurity.com/2016/09/08/avoid-certificate-pinning-latest-versions-android/ -- ? If you are just looking to intercept WebViews, then the Frida extension, appmon (which allows for API interception), using these techniques will work well -- https://youtu.be/...


5

Yes, given 1-3 you can be sure the connection is encrypted end-to-end between the browser and the server, and that a 3rd party cannot intercept the unencrypted message (without obtaining encryption keys through some other means).


5

It appears they're using the F5s SSL Proxy capability, which means that the F5 appliance isn't your application's client (they're not terminating at the appliance, but passing through) but instead gives them the ability to decrypt the the traffic to determine if if can be cached and re-used to improve performance. E.G., if they can cache some things at ...


5

You may want to ask the reporter to explain what they think the security implications are. Tricking the browser into showing a successful login via a locally forged API response does no harm unless the user can use that to actually bypass authentication or access confidential information. An attack would have to trick the server into assuming the ...


5

The packages in Debian-based distributions are cryptographically signed, tampering with them would be very difficult. (In fact, they typically use the same algorithm that is used to authenticate a server over HTTPS.) Sending packages over HTTP has a number of advantages: Intermediate proxies can cache the packages. (I run a local apt-cacher-ng instance ...


5

SSL Pinning is the additional layer of security implemented at the client side to let the mobile application only trust a particular SSL certificate during HTTPs connection establishment and not the certificates installed in the device trust store. Since the implementation is the client side implementation, it can be easily bypassed using the following ...


4

Its because the API destination cannot be hidden by SSL. Whats hidden by SSL, is the data, eg the request and response, including the path part of URL. So out of this url: https://www.example.org/search.php?sdata=somedata the following will be encrypted: /search.php?sdata=somedata the first part, https://www.example.org, will NOT be encrypted (read more why ...


4

According to Mozilla Telemetry half of the top results in the Google search used https in 04/2017 and they projected a further growth to 65% at the end of the year. And while it was once kind of used as an indicator of trust into the content of the site itself, https is now ubiquitous enough to protect traffic to sites delivering malware or phishing, either ...


4

You question of Does this mean I can copy a certificate from a client(Firefox's built in store, Android's, etc.) is answered by: SSLsplit can also use existing certificates of which the private key is available, instead of generating forged ones. Since you don't have the private keys for the CA certificates in the built in store you cannot use these....


4

Can a VPN Provider MitM my SSL traffic without me noticing? Regarding this specifically, unless they have the web site's private key, then you can notice. If you trust the VPN provider's certificate in your browser(s), then you have to actively look harder at which cert each site is using, of course, but you CAN notice if you pay attention. Browser ...


4

The SSL handshake includes random data from both client and server. While the attacker might replay the ClientHello which includes only the random data from the client he cannot complete the full handshake by just replaying previously captured data since the messages needed for completion also depend on the server side random data, which will change with ...


3

It is not possible to do SSL interception with current TLS protocols without terminating the SSL connection at the interceptor and creating a new one. Since the interceptor does not have the private key of the original certificate a new certificate has to be used which is visible by the client. In other words: giving the information that the ...


3

First note that on most cases the network administrators will not watch your traffic, even if they could. So the following only outlines the ways administrators could in theory watch your traffic if they really want to. I am using my own device on their wifi network, so there is no possibility of a fake CA being installed on my system? You might not be ...


3

How do I prevent the other end from finding out which website I'm visitting on the server? (Obviously not by using VPN or proxies.) You've identified the primary method. Theoretically, you can send one host name as part of SNI, and a different one in the http Host header. However, Apache at least prevents you from doing this.


Only top voted, non community-wiki answers of a minimum length are eligible