Ruin My Search History

Post by [deleted] » Fri, Jun 10, 2016, 1:01 AM UTC

jimreynold2nd wrote: post #58

colemickens wrote: post #38

Earlier quoted context omitted.

I'm no security expert, but I was under the impression that HSTS pinning would make that hard to do, especially on sites like google.com. And I can't quite parse your sentence to know if you're implying that all companies do... (or just that I shouldn't be so naive as to assume none are), but I can see the cert chain for google.com in my browser at ${big_company} and it doesn't seem like I'm being MITM'd.

It relies on HTTPS, which relies on certificates telling the browser that the website is what it claims to be, which relies on a list of trusted root CA certificates installed on your computer, which the company controls. Most companies will install a trusted root CA cert that is themselves onto employee computers (otherwise you'll get SSL errors when accessing internal HTTPS pages since they're not signed with those…

Post by [deleted] » Fri, Jun 10, 2016, 1:03 AM UTC

jimreynold2nd wrote: post #58

colemickens wrote: post #38

Earlier quoted context omitted.

I'm no security expert, but I was under the impression that HSTS pinning would make that hard to do, especially on sites like google.com. And I can't quite parse your sentence to know if you're implying that all companies do... (or just that I shouldn't be so naive as to assume none are), but I can see the cert chain for google.com in my browser at ${big_company} and it doesn't seem like I'm being MITM'd.

It relies on HTTPS, which relies on certificates telling the browser that the website is what it claims to be, which relies on a list of trusted root CA certificates installed on your computer, which the company controls. Most companies will install a trusted root CA cert that is themselves onto employee computers (otherwise you'll get SSL errors when accessing internal HTTPS pages since they're not signed with those…

Post by BrandonY » Fri, Jun 10, 2016, 1:08 AM UTC

colemickens wrote: post #38

recursive wrote: post #34

Earlier quoted context omitted.

Are there really people that believe there's a possibility that they don't?

I'm no security expert, but I was under the impression that HSTS pinning would make that hard to do, especially on sites like google.com. And I can't quite parse your sentence to know if you're implying that all companies do... (or just that I shouldn't be so naive as to assume none are), but I can see the cert chain for google.com in my browser at ${big_company} and it doesn't seem like I'm being MITM'd.

Post by nostromo » Fri, Jun 10, 2016, 1:11 AM UTC

colemickens wrote: post #62

nostromo wrote: post #60

Earlier quoted context omitted.

Here's a good write-up on how to see if your company is listening in on your encrypted web traffic: http://security.stackexchange.com/a/2920 (Note: MITM is just one way companies monitor employees, but by no means the only way. If your company provided your work computer to you, or if they installed anything on your BYOD computer, I would treat everything you do on that computer as cc'ed to your boss by default.)

I mean, that's how I MITM SSL traffic on a daily basis to do development. None of that speaks to HSTS/Pinning... which is the feature meant to protect against this sort of thing. I'm specifically asking about how a company can bypass HSTS/Pinning without modifying my local browser. Everything I'm reading indicates that's not possible.

Post by colemickens » Fri, Jun 10, 2016, 1:12 AM UTC

nostromo wrote: post #67

colemickens wrote: post #62

Earlier quoted context omitted.

I mean, that's how I MITM SSL traffic on a daily basis to do development. None of that speaks to HSTS/Pinning... which is the feature meant to protect against this sort of thing. I'm specifically asking about how a company can bypass HSTS/Pinning without modifying my local browser. Everything I'm reading indicates that's not possible.

https://developer.mozilla.org/en-US/docs/Web/Security/Public... >Firefox (and Chrome) disable Pin Validation for Pinned Hosts whose validated certificate chain terminates at a user-defined trust anchor (rather than a built-in trust anchor). This means that for users who imported custom root certificates all pinning violations are ignored. That last sentence is key. From Wikipedia: some browsers "disable pinning for c…