231 votes

My college is forcing me to install their SSL certificate. How to protect my privacy?

Don't install their certificate on any device/OS installation which you ever want to use for private activity. Once you do, your traffic is subject to MITM attacks even if you are not using your ...
user avatar
145 votes

My college is forcing me to install their SSL certificate. How to protect my privacy?

A VPN is certainly a good solution, provided they don't block that, too. The best solution for protecting your privacy, though, is probably to try your hardest to get this policy overturned. This is ...
user avatar
  • 2,693
74 votes

My college is forcing me to install their SSL certificate. How to protect my privacy?

Your college is providing the "network connection" service under some conditions, one of them being the ability for the college system administrators to inspect all the traffic. While it is tempting ...
user avatar
62 votes

My college is forcing me to install their SSL certificate. How to protect my privacy?

Don't use their network for anything personal. That's the best way to protect your privacy from them. If you don't have any choice, then use a Virtual Machine, and install the certificate on the ...
user avatar
  • 22.5k
45 votes

My college is forcing me to install their SSL certificate. How to protect my privacy?

If ssh is not filtered out, then you can use ssh to produce a SOCKS proxy running over an ssh tunnel. You need not install any software to make this work. You do not need VPN software. The following ...
user avatar
  • 2,026
37 votes
Accepted

Is there any point in having the HSTS header enabled when using HTTP/2?

Yes, HSTS is still needed, including HSTS preload. The way a browser connects to HTTP/2 is through a URL that looks exactly the same as the URL for HTTP/1, so it doesn't know that it must be HTTP/2 ...
user avatar
  • 7,648
28 votes

Can a secure cookie be set from an insecure HTTP connection? If so, why is it allowed?

Secure cookies can be set over insecure channels (e.g. HTTP) as per section 4.1.2.5 of RFC 6265. It explicitly mentions that the Secure flag only provides confidentiality and not integrity, as a ...
user avatar
  • 132k
24 votes

Does sslstrip work only on websites which use both HTTP and HTTPS?

SSL Strip only works on websites which uses both HTTP & HTTPS. That's not accurate because it implies turning off HTTP support secures against the attack. The point is that sslstrip steps in ...
user avatar
  • 43.7k
18 votes

My college is forcing me to install their SSL certificate. How to protect my privacy?

Read the T&C's. See if you are allowed to use a VPN (some protocols may be forbidden, VPNs may be too). If you are, then use a VPN, and never connect to any site directly through their network. (...
user avatar
  • 333
17 votes
Accepted

Is an HTTP 301 redirect to HTTPS, insecure?

Since you're doing a 301 redirect over HTTP, someone could man-in-the-middle that connection and redirect you anywhere they wanted - in particular they could actually not redirect you at all, and ...
user avatar
16 votes
Accepted

What is the difference between MITMproxy and SSLsplit?

[Disclaimer: I'm one of the mitmproxy authors. My opinions may be biased. :)] sslsplit sslsplit is a transparent proxy that can intercept TLS connections using a man-in-the-middle attack. sslsplit ...
user avatar
12 votes

Why is the deprecated SSL 2.0 protocol considered insecure and how can it be exploited?

SSL 2.0 is not a vulnerability; it is a protocol which happens to contain structural vulnerabilities, and, as such, should not be allowed. There is a RFC which says just that, and lists the main known ...
user avatar
  • 168k
11 votes
Accepted

Mitigating SSLStrip by only serving a site over HTTPS?

Yes, without further measures, the attacker still can perform SSLStrip. For SSLStrip to work, the attacker only needs to be a man in the middle, unrelated from your behaviour regarding HTTP. On an ...
user avatar
  • 4,305
11 votes

My college is forcing me to install their SSL certificate. How to protect my privacy?

Don't use the network. That's pretty much your only option. Any attempt at circumventing their "security" measures would most likely be considered "unauthorized access" under the CFAA (assuming US ...
user avatar
  • 82k
10 votes

My college is forcing me to install their SSL certificate. How to protect my privacy?

is forcing us to install Cyberoam Firewall SSL certificate so that they can view all the encrypted traffic to "improve our security". Malware is sent over HTTPS too, so it probably is really their ...
user avatar
10 votes
Accepted

Ways to defeat SSL

sslstrip: This is a downgrade attack, i.e. browser is forced to use insecure HTTP instead of HTTPS. It is still possible, but can be mitigated by the server with HSTS, at least for supported browsers. ...
user avatar
8 votes
Accepted

SSLStrip vs HSTS

There is no new version of sslstrip since 2011 and the feature is already there. How It works: First you need to know about the HSTS headers. SSLStrip will work when server sends HSTS header for the ...
user avatar
  • 2,499
8 votes
Accepted

Does HSTS make using a public WiFi safe?

Short answer: Yes, for resonable defintions of safe. HSTS protects you against sslstrip type attacks for sites you have visited recently using a non-compromised connection (or for some browsers ...
user avatar
  • 4,899
8 votes
Accepted

Is Android Gmail app susceptible to MITM, sslstrip? If yes, how?

SSL-strip is not an issue when you are using an app, it is only an issue when you are browsing the web through a browser. It works by replacing HTTPS links with HTTP links in an HTTP page. Since the ...
user avatar
  • 64.2k
7 votes
Accepted

How does bypassing HSTS with SSLSTRIP+ work exactly?

This is answered going off the available information you linked to. How exactly is the victim being redirected. Does the DNS packet contain some sort of redirect? Or is it something else that ...
user avatar
5 votes
Accepted

SSLstrip attack on HTTPS request

No, that is not possible. In case the user types 'https://', the secure tunnel is generated, and SSLStrip cannot interfere anymore. SSLStrip works by intercepting HTTPS redirects sent from the ...
user avatar
  • 5,363
5 votes

My college is forcing me to install their SSL certificate. How to protect my privacy?

How would they be able to verify whether or not you had/had not installed their SSL certificate? Are they also running software on your local machine? Otherwise I would think the adverse effects would ...
user avatar
5 votes

Is an HTTP 301 redirect to HTTPS, insecure?

From this question it may look like the 301 redirect per se is posing a threat, but it is not. It doesn't pose a security threat. It only bears the same risks of serving a normal HTTP page.
user avatar
  • 149
5 votes
Accepted

Why does SSLStrip fail when user types HTTPS?

SSLstrip works by replacing HTTPS links in web pages returned by the server with HTTP links. This happens during a standard HTTP request, response exchange. While the initial HTTPS call isn't ...
user avatar
5 votes

Can the network administrator of my university see what I have searched on Google?

Yes, given 1-3 you can be sure the connection is encrypted end-to-end between the browser and the server, and that a 3rd party cannot intercept the unencrypted message (without obtaining encryption ...
user avatar
  • 9,131
5 votes

Does sslstrip work only on websites which use both HTTP and HTTPS?

Sslstrip requires that the connection between the client and the sslstrip instance is done over plain HTTP. The connection from sslstrip to the server can be either HTTP and HTTPS. This means that if ...
user avatar
4 votes

How does SSLstrip work?

Talking about possible solutions: The only truly reliable way to prevent/detect SSL stripping is using always-encrypted communication & side-channel authentication of the TLS (basically use the ...
user avatar
  • 61
4 votes

Mitigating SSLStrip by only serving a site over HTTPS?

If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are you still vulnerable? If the user accidentally enters http://example.com in their address bar ...
user avatar
4 votes

SSL stripping in home network

If I am not mistaken, importing your own SSL certificates is just for the connections which you make to the device's own web interface so that won't help you to accomplish your goal. What you would ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible