Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

Post by cbd1984 » Sat, Feb 21, 2015, 4:58 PM UTC

patcheudor wrote: post #21

I went to Best Buy as well today and picked up a laptop to look into this further. The Superfish software is not properly passing the validation state of the public cert when it connects to a website like Bank of America as an example. There's no need to export their private and use it in a MitM transparent proxy. The software is simply not triggering appropriate warnings when provided an obviously fake certificate t…

Post by cbd1984 » Sat, Feb 21, 2015, 6:00 PM UTC

cbd1984 wrote: post #181

PDF

Post by vpeters25 » Sat, Feb 21, 2015, 6:34 PM UTC

skuhn wrote: post #50

vpeters25 wrote: post #37

Earlier quoted context omitted.

The company I work for has a strict policy of no direct outbound connections from the corporate network. This is to prevent (or just make harder) for compromised machines from "phoning home". This has the unfortunate side effect that all internet traffic must go through a proxy, they have to MiTM SSL traffic. I just use my smartphone's data for any personal internet browsing.

Well you don't have to MITM SSL in order to proxy it, it can be done in other ways. They probably choose to do so in order to see the details of the request.

Post by mynameisvlad » Mon, Feb 23, 2015, 7:56 PM UTC

dang wrote: post #175

SquareWheel wrote: post #113

Earlier quoted context omitted.

I had no idea that was even an option, and I've been here for a few years now. I thought only threads could be flagged. Is comment flagging hidden from the main page to prevent accidental clicks, or its use as a "super downvote"?

It is an intentional speed-bump to cut down on reflexive flagging. Since the feature is non-obvious, I post descriptions like the above semi-regularly in the hope of getting the word out.