4 ms·
> or (2) the user to install a certificate generated by the person doing the MITM You mean like that "setup software" Comcast spent ages trying to pretend I ha
by awj 7y ago
> or (2) the user to install a certificate generated by the person doing the MITM
You mean like that "setup software" Comcast spent ages trying to pretend I had to install just to get things running?
I ran Linux in those days, which always meant a little extra support time but I never had to install jack.
- jimktrains2 7y agoThat's quite possible, but many apps and browsers pin certificates and this would probably be reported quickly?
- judge2020 7y agohttps://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#How-does-key-pinning-interact-with-local-proxies-and-filters https://chromium.googlesource.com/chromium/src/+/master/docs... > Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites.
- jimktrains2 7y agoI was going off remembering this. > Late on December 24, Chrome detected and blocked an unauthorized digital certificate for the "*.google.com" domain. https://security.googleblog.com/2013/01/enhancing-digital-certificate-security.html?m=1 https://security.googleblog.com/2013/01/enhancing-digital-ce...
- LocalPCGuy 7y agoPretty sure chrome has it's own code to detect Google certs and report invalid ones back to Google.