Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ruin My Search History

ruinmysearchhistory.com

Post reply on HN
Print view View original

51–60 of 211 posts

Re: Ruin My Search History

#51

Post by colemickens »

sillysaurus3 wrote: post #46
colemickens wrote: post #38

Earlier quoted context omitted.

I'm no security expert, but I was under the impression that HSTS pinning would make that hard to do, especially on sites like google.com. And I can't quite parse your sentence to know if you're implying that all companies do... (or just that I shouldn't be so naive as to assume none are), but I can see the cert chain for google.com in my browser at ${big_company} and it doesn't seem like I'm being MITM'd.

Rule of thumb: if an adversary has physical access to your computer, treat it as compromised.

Okay? I'm very familiar with that principle, but I don't understand how to take that statement and apply it to the situation at hand. No one has ever operated this computer except me (though I did enroll the corp wifi certs).

So again, how could I be MITM'd without being aware of it, given HSTS?

Yes, someone could have snuck in a hacked copy of Chrome Canary that exposes phony cert chain information... but that's not what we were talking about, and I don't think most IT departments have the sophistication required to pull that off.

Re: Ruin My Search History

#52

Post by monknomo »

colemickens wrote: post #20
nostromo wrote: post #12

Warning: people should know this is NSFW for anyone with a company that monitors your web usage. I also wouldn't run this from an authoritarian country where local officials may not appreciate the joke.

Do companies really MITM SSL traffic in order to watch employees surfing habits?

Yep, IronPort is one product, but our network guys have been saying something about it being built into the latest Cisco series 6 routers?

That's the enterprise life

Re: Ruin My Search History

#53

Post by i336_ »

slyall wrote: post #44
i336_ wrote: post #28

Related: https://www.reddit.com/r/AmazonWTF/ (NSFW!!) I've heard people complain after being subscribed to that subreddit that Amazon's relevance engine becomes unusable for them (and while unsaid, I imagine they can't browse Amazon with anyone else at their computer). OP, take note. :P

I had a weird one yesterday. I went to the New York Times using private browsing and read a single article in the relationship section (something about wedding speeches) and then noticed that the next page I went to 90% of the recommended articles were engagement announcements. I guess things are hard when you only have a single data-point to base recommendations off.

Very true. The difficult problem in this case is that it's impossible to serve anything else, even though there are various techniques out there that still identify you when using private browsing (such as canvas fingerprinting - https://securehomes.esat.kuleuven.be/~gacar/persistent/index...): even if they're using such techniques under the hood (and that study, apparently from 2014, says 5.5% of top 100k sites were using it), they can't use it for recommendations, for obvious reasons (browser vendors would get eaten alive, private browsing would be overhauled, this technique would no longer work, everyone goes home sad).

Re: Ruin My Search History

#54

Post by detaro »

colemickens wrote: post #51
sillysaurus3 wrote: post #46

Earlier quoted context omitted.

Rule of thumb: if an adversary has physical access to your computer, treat it as compromised.

Okay? I'm very familiar with that principle, but I don't understand how to take that statement and apply it to the situation at hand. No one has ever operated this computer except me (though I did enroll the corp wifi certs). So again, how could I be MITM'd without being aware of it, given HSTS? Yes, someone could have snuck in a hacked copy of Chrome Canary that exposes phony cert chain information... but that's not…

If you enrolled the wifi certs into your system certificate store, certificates signed by them ignore HSTS, for exactly this use case.

Re: Ruin My Search History

#56

Post by colemickens »

detaro wrote: post #54
colemickens wrote: post #51

Earlier quoted context omitted.

Okay? I'm very familiar with that principle, but I don't understand how to take that statement and apply it to the situation at hand. No one has ever operated this computer except me (though I did enroll the corp wifi certs). So again, how could I be MITM'd without being aware of it, given HSTS? Yes, someone could have snuck in a hacked copy of Chrome Canary that exposes phony cert chain information... but that's not…

If you enrolled the wifi certs into your system certificate store, certificates signed by them ignore HSTS, for exactly this use case.

I can't find any information about this. Can you point me at some additional information? Thank you in advance!

Re: Ruin My Search History

#57

Post by HannibalLecter »

_alaeri wrote: post #29

Reddit has kind of a cool discussion about it there: https://www.reddit.com/r/InternetIsBeautiful/comments/4nc763...

Reddit is the worst thing to happen to Ycomb in forever. The recent dead canary, the tracking users offline, and the bait & switch CEO shit with Pao (who was their scapegoat)... it all adds up to something far worse than Digg ever was. All Digg tried to do was change their UI and spam people. Reddit is trying to fingerprint each user for the NSA.

Re: Ruin My Search History

#58

Post by jimreynold2nd »

colemickens wrote: post #38
recursive wrote: post #34

Earlier quoted context omitted.

Are there really people that believe there's a possibility that they don't?

I'm no security expert, but I was under the impression that HSTS pinning would make that hard to do, especially on sites like google.com. And I can't quite parse your sentence to know if you're implying that all companies do... (or just that I shouldn't be so naive as to assume none are), but I can see the cert chain for google.com in my browser at ${big_company} and it doesn't seem like I'm being MITM'd.

It relies on HTTPS, which relies on certificates telling the browser that the website is what it claims to be, which relies on a list of trusted root CA certificates installed on your computer, which the company controls. Most companies will install a trusted root CA cert that is themselves onto employee computers (otherwise you'll get SSL errors when accessing internal HTTPS pages since they're not signed with those public root CAs).

Re: Ruin My Search History

#59

Post by trjordan »

mmastrac wrote: post #2

Spoiler alert! From the base64 encoded array in the source: ['how to appear funny', 'why are my thumbs uneven', 'am i lack toast and tolerant', 'your youre difference', 'why doesnt my poo float', 'midget google images', 'tall midgets??', 'homemade lube?', 'i hate my boss', 'what counts as fat', 'how to tell partner they fat', 'is it normal to still love my ex', 'how to get back with ex', 'penis remove dog how to', 'r…

It's not JUST that, though -- it also modifies "my city" and "this country" to be your location, too!

Re: Ruin My Search History

#60

Post by nostromo »

colemickens wrote: post #56
detaro wrote: post #54

Earlier quoted context omitted.

If you enrolled the wifi certs into your system certificate store, certificates signed by them ignore HSTS, for exactly this use case.

I can't find any information about this. Can you point me at some additional information? Thank you in advance!

Here's a good write-up on how to see if your company is listening in on your encrypted web traffic:

http://security.stackexchange.com/a/2920

(Note: MITM is just one way companies monitor employees, but by no means the only way. If your company provided your work computer to you, or if they installed anything on your BYOD computer, I would treat everything you do on that computer as cc'ed to your boss by default.)

Post reply on HN