51
votes
Accepted
Why is the issuer certificate different at my workplace and at home?
Yes, a company doing SSL interception could in theory read all your traffic if you use the company network. Depending on where you live and what kind of contract you have the ability for the company ...
- 198k
41
votes
Accepted
SSL issue captures Facebook app send out traffic
Facebook uses Certificate Pinning which prevents attacks like yours.
What Is Pinning?
Pinning is the process of associating a host with their expected X509 certificate or public key. Once a ...
- 12.2k
39
votes
As a contractor how do I work on multiple client networks without data leakage?
You could use a very small VM for each one, but keep the IDE on the host, not on the guests. Share a folder from the VM to the host, so you use the host and its resources to develop, and use the VM ...
- 53.5k
32
votes
Accepted
Can a VPN Provider MitM my SSL traffic without me noticing?
How does the provider forward the traffic without exposing my IP, but also without breaking the SSL.
SSL is protection (like encryption) on top of TCP which sits on top of IP. The underlying layers (...
- 198k
23
votes
Accepted
My school wifi asks to 'trust' a certificate on iPhones. Does this allow them to view SSL traffic?
It's ok. The certificate you installed and trusted is used to provide you secure authentication against their RADIUS server and prevent you from connecting to rogue RADIUS server. If someone decides ...
- 6,232
17
votes
Accepted
Can firewalls decrypt SSL packets?
SSL/TLS is a protocol providing an end-to-end encrypted communication between two parties each having one of the keys in private/public key pair. Typically a browser and a web server.
In normal ...
- 9,149
17
votes
Accepted
Hide clear SNI when using https
It is not possible to hide the SNI information if the server requires it to serve the proper certificate. There was discussion on encrypting this information in TLS 1.3. But this idea was abandoned ...
- 198k
16
votes
As a contractor how do I work on multiple client networks without data leakage?
If you use a operating system that has support for separate networking namespaces, use that feature to start each VPN client and all applications in a distinct client-namespace.
There are a lot of ...
- 5,973
14
votes
Are future TLS versions going to prevent traffic inspection?
TLS by itself protects the sniffing and modification of traffic between two endpoints, i.e. client and server. TLS interception just makes two TLS connections where only one was, i.e. client to ...
- 198k
14
votes
Accepted
If a WAF is compromised, can the adversary view all the traffic in clear text provided WAF uses SSL cert to decrypt it?
Yes, the configuration is as follows:
[client web browser] <--TLS--> [WAF] <--TLS--> [origin web server]
So, the WAF essentially has a 'man in the middle' (MITM) position between the ...
- 22.7k
12
votes
Accepted
Are future TLS versions going to prevent traffic inspection?
No.
AFAIK there is nothing inside the TLS 1.3 Draft about that. And I don't think there's a technical solution to this either. If you allow somebody to install an additional root CA on your computer, ...
- 18k
11
votes
Accepted
How to mitigate credential disclosure in man in the middle attack
The Secure Remote Password (SRP) protocol can be used to send credentials over an unencrypted network.
You could also require SSL/TLS client authentication which will prevent the proxy from being ...
- 759
10
votes
Why is the issuer certificate different at my workplace and at home?
In addition to scanning for malware, corporate IT also uses TLS intercept for data loss prevention (DLP), eg. making sure you're not sending proprietary documents through your personal e-mail.
In ...
- 1,942
10
votes
Can a VPN Provider MitM my SSL traffic without me noticing?
The short answer is: Your VPN provider can do anything your ISP can do if you're not using a VPN.
This may include breaking TLS, if your browser trusts a root CA, which issued an intermediate ...
- 3,382
10
votes
How can police get someone's search history?
What are the possible ways they can do that?
The main ways police can obtain search records are by:
Looking at local browser history on the suspect's computer (as you mentioned).
Demanding ...
- 66.5k
9
votes
Accepted
Can a man in the middle hear half the HTTPS conversation
No. A cryptographic system that only protected half of the information would just be slightly better than useless.
During the handshake, a symmetric key is exchanged. After the handshake, that ...
- 65.4k
9
votes
Accepted
Disable or bypass SSL Pinning/Certificate Pinning on Android 6.0.1
Did you go through these procedures to get JustTrustMe to bypass the cert pinning -- http://www.welivesecurity.com/2016/09/08/avoid-certificate-pinning-latest-versions-android/ -- ?
If you are just ...
- 19k
9
votes
Accepted
Can I use CloudFlare if I want to avoid NSA and FISA secret orders?
First of all, just because you use CloudFlare does not mean that the traffic will pass through the US. CloudFlare currently has 102 edges, and requests will be sent to the nearest one. This is what is ...
- 65.4k
9
votes
Accepted
How to check Google SSL certificate?
Based on your description and the link you've provided you've likely installed a CA certificate for SSL interception.
... how do I know the certificate I have is legit? That is, actually comes ...
- 198k
9
votes
Can messages be intercepted when in airplane mode?
The way several messaging apps work is the message I send is encrypted when sent to the server, then decrypted, and then sent to the intended client in a decrypted state.
I am unaware of any instant ...
- 11.5k
8
votes
Accepted
Is it acceptable for an employer to install a self-signed root certificate on employees personal devices at home?
This is not a strictly a legal or technical question, but rather an opinion question - "is it acceptable?" Is it acceptable to you?
You bring up a perfectly reasonable technical point though - in ...
- 1,942
8
votes
Accepted
How can I intercept Android application's SSL traffic where SSL pinning is used?
SSL Pinning is the additional layer of security implemented at the client side to let the mobile application only trust a particular SSL certificate during HTTPs connection establishment and not the ...
- 965
8
votes
Accepted
Is there no way to bypass certificate pinning without patching apps?
No, there is no way to bypass certificate pinning without application patching or using debugger (tracer). The reason is that, in simple words, certificate pinning is when a CA certificate is ...
- 1,264
7
votes
Accepted
Securing a Web application using HSTS
Being able to intercept SSL traffic with an imported root certificate is not considered a weakness of the web application. It's a browser design decision to allow the import of custom local trust ...
- 44.7k
7
votes
Why is the issuer certificate different at my workplace and at home?
Being able to "read" all your encrypted communication doesn't necessarily mean someone is literally sitting at a computer and looking at your data. The "man in the middle" is generally a firewall or ...
- 266
7
votes
As a contractor how do I work on multiple client networks without data leakage?
Enable split tunneling, so the only traffic that goes across the VPN to Client X is traffic bound for their servers.
6
votes
Accepted
Is SSL Interception possible without disabling Public Key Pinning on the client side?
In case of legal SSL interception the proxy CA which is used to issue the certificates for the intercepted connections gets explicitly imported into the browser/OS as trusted. In such a case browser ...
- 198k
6
votes
Is this threat in SSL for real?
Anyone can compromise the DNS request authority chain (true).
Not true on a global scale but true inside a network you kind of control. This might be a network with weak security (i.e. typical free ...
- 198k
6
votes
Accepted
Preventing a Burp and Intercept
You may want to ask the reporter to explain what they think the security implications are.
Tricking the browser into showing a successful login via a locally forged API response does no harm unless ...
- 44.7k
Only top scored, non community-wiki answers of a minimum length are eligible