50

Yes, a company doing SSL interception could in theory read all your traffic if you use the company network. Depending on where you live and what kind of contract you have the ability for the company to do this might also be somehow part of the contract or working rules which might also include that you are only allowed to use the company network for work ...


39

You could use a very small VM for each one, but keep the IDE on the host, not on the guests. Share a folder from the VM to the host, so you use the host and its resources to develop, and use the VM networking to access the client environment. Most of the VPN software can run on Linux, so you could create a very light Linux guest with 256MB of memory and ...


31

How does the provider forward the traffic without exposing my IP, but also without breaking the SSL. SSL is protection (like encryption) on top of TCP which sits on top of IP. The underlying layers (TCP, IP) can be changed without changing the data transported. This means that the encryption can be kept even though your IP address at the network layer is ...


20

It's ok. The certificate you installed and trusted is used to provide you secure authentication against their RADIUS server and prevent you from connecting to rogue RADIUS server. If someone decides to steal your Active Directory credentials by installing a rogue RADIUS server your phone will pop up with a warning that RADIUS certificate is not trusted. By ...


16

If you use a operating system that has support for separate networking namespaces, use that feature to start each VPN client and all applications in a distinct client-namespace. There are a lot of tutorials how to achieve that with Linux: e.g. this or this and there is also a tag on unix stack exchange. This approach uses a lot less resources than starting ...


15

SSL/TLS is a protocol providing an end-to-end encrypted communication between two parties each having one of the keys in private/public key pair. Typically a browser and a web server. In normal circumstances any device between the two endpoints cannot decrypt the communication. That includes firewalls. It is however possible (and used in organizations) to ...


15

It is not possible to hide the SNI information if the server requires it to serve the proper certificate. There was discussion on encrypting this information in TLS 1.3. But this idea was abandoned since this would require establishing an additional encryption layer and thus adding additional overhead to the connection establishment. Apart from that this ...


14

TLS by itself protects the sniffing and modification of traffic between two endpoints, i.e. client and server. TLS interception just makes two TLS connections where only one was, i.e. client to interception device and interception device to server. This will still work with future TLS versions. TLS interception is only possible if the validation of the ...


12

No. AFAIK there is nothing inside the TLS 1.3 Draft about that. And I don't think there's a technical solution to this either. If you allow somebody to install an additional root CA on your computer, then all bets are off.


11

The Secure Remote Password (SRP) protocol can be used to send credentials over an unencrypted network. You could also require SSL/TLS client authentication which will prevent the proxy from being able to establish a connection to the web server.


10

The short answer is: Your VPN provider can do anything your ISP can do if you're not using a VPN. This may include breaking TLS, if your browser trusts a root CA, which issued an intermediate certificate for middle boxes. You're shifting the trust in not doing so from your ISP to the VPN provider. Most such middle boxes require the users to install a new ...


9

No. A cryptographic system that only protected half of the information would just be slightly better than useless. During the handshake, a symmetric key is exchanged. After the handshake, that symmetric key is used to encrypt all data (usually with AES). So without that symmetric key you are toast - you can not read 50%, you can read 0%. When RSA is used ...


9

First of all, just because you use CloudFlare does not mean that the traffic will pass through the US. CloudFlare currently has 102 edges, and requests will be sent to the nearest one. This is what is called "anycast". So if someone in Europe requests your page the request will go from them to an edge somewhere in Europe, and from there to your origin. In ...


9

In addition to scanning for malware, corporate IT also uses TLS intercept for data loss prevention (DLP), eg. making sure you're not sending proprietary documents through your personal e-mail. In most medium to large companies, you must sign an "Acceptable Use Policy" as a condition of employment, and that policy will explicitly state that they are allowed ...


9

What are the possible ways they can do that? The main ways police can obtain search records are by: Looking at local browser history on the suspect's computer (as you mentioned). Demanding connection logs from the ISP, revealing what sites have been visited. Demanding connection records from the sites that you have visited. Demanding search records from ...


9

Based on your description and the link you've provided you've likely installed a CA certificate for SSL interception. ... how do I know the certificate I have is legit? That is, actually comes from Google and not from a man in the middle? It does not come from Google. It comes from a man in the middle. It might be a legit man in the middle or not. It is ...


8

Did you go through these procedures to get JustTrustMe to bypass the cert pinning -- http://www.welivesecurity.com/2016/09/08/avoid-certificate-pinning-latest-versions-android/ -- ? If you are just looking to intercept WebViews, then the Frida extension, appmon (which allows for API interception), using these techniques will work well -- https://youtu.be/...


8

This is not a strictly a legal or technical question, but rather an opinion question - "is it acceptable?" Is it acceptable to you? You bring up a perfectly reasonable technical point though - in that a root cert in your system store allows the controller of that cert to potentially impersonate and intercept any of your SSL/TLS traffic via MitM techniques. ...


8

No, there is no way to bypass certificate pinning without application patching or using debugger (tracer). The reason is that, in simple words, certificate pinning is when a CA certificate is hardcoded into application. This application sets the certificate as the only root of trust to establish a network connection. On Android it's carried out via ...


7

Being able to intercept SSL traffic with an imported root certificate is not considered a weakness of the web application. It's a browser design decision to allow the import of custom local trust anchors. Does implementing the HSTS solving the problem I have? No. A HTTP Strict Transport Security header just enforces HTTPS. HSTS doesn't care which ...


7

Being able to "read" all your encrypted communication doesn't necessarily mean someone is literally sitting at a computer and looking at your data. The "man in the middle" is generally a firewall or proxy appliance, where the IT/Security administrators create rules to block or flag certain types of content. The appliance inspects the packets in plain-text, ...


7

Enable split tunneling, so the only traffic that goes across the VPN to Client X is traffic bound for their servers.


6

In case of legal SSL interception the proxy CA which is used to issue the certificates for the intercepted connections gets explicitly imported into the browser/OS as trusted. In such a case browser will ignore both the builtin pinning and also the pinning done with HPKP header. This is explicitly done this way to make legal SSL interception (in firewalls, ...


6

BurpSuite will not intercept server responses by default and display them to you. To enable this functionality go to: Proxy -> Options -> Intercept Server Responses And make sure to check the box next to Intercept responses based on the following rules Then either select one of the displayed rules or add one like the highlighted one below: Also make ...


6

Anyone can compromise the DNS request authority chain (true). Not true on a global scale but true inside a network you kind of control. This might be a network with weak security (i.e. typical free hotspots). Or it might be a network where you own the router or similar. There are countries where this kind of control is done on a state wide scale. Anyone ...


6

SSL Pinning is the additional layer of security implemented at the client side to let the mobile application only trust a particular SSL certificate during HTTPs connection establishment and not the certificates installed in the device trust store. Since the implementation is the client side implementation, it can be easily bypassed using the following ...


6

TL;DR: No. That's not how certificates or pinning work. All certificate pinning does is limit the root of the trust chain to a smaller set, for a specific domain. It doesn't change how the certificates work. It only adds a new constraint on acceptable roots, without disabling any others, and they all have to match -- domain name, date, etc., and now pinned ...


6

Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL inspection, unless the administrator specifically exempts them Yes,You are right the apps that use certificate pinning wont work in an MITM situation.They didnt work when i tried so i think its a fair assumption to make that they wont ...


6

If you are on a Linux laptop, I recommend a separate Linux user for each client. Those separate users can each have their own scripts to connect to a network and VPN if necessary. With this method and setting proper permissions, unless you deliberately su to another user you are almost assured to not cross-contaminate. I recommend having another user for ...


5

Yes, given 1-3 you can be sure the connection is encrypted end-to-end between the browser and the server, and that a 3rd party cannot intercept the unencrypted message (without obtaining encryption keys through some other means).


Only top voted, non community-wiki answers of a minimum length are eligible