Windows SSL Interception Gone Wild
facebook.com
Windows SSL Interception Gone Wild
1–10 of 137 posts
Re: Windows SSL Interception Gone Wild
#2Just to be clear, Facebook and Google hate any software that allows users to modify content within their walled gardens (whether that's an adblock, ad injector, or other). These companies want a totally controllable user experience in order to maximize their own user metrics and monetization.
My fear is that these companies will use this Superfish debacle to attack and restrict the ability for users to download legitimate software which leverages these technologies. As users and developers, we want to retain this ability.
Adware sucks, and there are dozens of anti-virus companies who should be all over anyone who tries to pull this crap. The problem here is not with MITM, SSL packet inspection or modification. The problem here is that Lenovo allowed themselves to be turned into a distribution channel for a poorly implemented, spammy piece of adware for a few extra pennies.
Re: Windows SSL Interception Gone Wild
#3> Superfish uses a third party library from a company named Komodia to modify the Windows networking stack
This is the second article I've read that states this - Superfish does no such thing.
Re: Windows SSL Interception Gone Wild
#4Just to be clear, Facebook and Google hate any software that allows users to modify content within their walled gardens (whether that's an adblock, ad injector, or other). These companies want a totally controllable user experience in order to maximize their own user metrics and monetization. My fear is that these companies will use this Superfish debacle to attack and restrict the ability for users to download legit…
I'm not sure why a normal user would ever need to add CAs to their root store. Can you clarify?
Re: Windows SSL Interception Gone Wild
#5Just to be clear, Facebook and Google hate any software that allows users to modify content within their walled gardens (whether that's an adblock, ad injector, or other). These companies want a totally controllable user experience in order to maximize their own user metrics and monetization. My fear is that these companies will use this Superfish debacle to attack and restrict the ability for users to download legit…
I'm not sure why a normal user would ever need to add CAs to their root store. Can you clarify?
Realizing an adblock mechanism, for one. (Similar to InterMute in late 90s, and admucher.com now.)
Re: Windows SSL Interception Gone Wild
#6Ah, so this is why Facebook tries to load Flash on almost every page... Allows them to gather data like this. Always wondered why Flash was "needed".
(another reason to put Flash behind click-to-play and/or push for HTML5 video)
Re: Windows SSL Interception Gone Wild
#7Just to be clear, Facebook and Google hate any software that allows users to modify content within their walled gardens (whether that's an adblock, ad injector, or other). These companies want a totally controllable user experience in order to maximize their own user metrics and monetization. My fear is that these companies will use this Superfish debacle to attack and restrict the ability for users to download legit…
I'm not sure why a normal user would ever need to add CAs to their root store. Can you clarify?
Depends on what you mean by "normal user." It's somewhat advanced, for sure, but many companies use private CAs to issue certs for their intranet sites, and the ability to install those certs on client machines is very useful.
Re: Windows SSL Interception Gone Wild
#8Just to be clear, Facebook and Google hate any software that allows users to modify content within their walled gardens (whether that's an adblock, ad injector, or other). These companies want a totally controllable user experience in order to maximize their own user metrics and monetization. My fear is that these companies will use this Superfish debacle to attack and restrict the ability for users to download legit…
I'm not sure why a normal user would ever need to add CAs to their root store. Can you clarify?
Plenty of enterprise users need to. There are other reasons too.
I presume 'nugget is talking about the HTML rewriting aspect of the software. Injecting additional/unwanted tracking code == bad, user-requested re-writing of content == good.
Re: Windows SSL Interception Gone Wild
#9Re: Windows SSL Interception Gone Wild
#10"We've observed more than a dozen other software applications using the Komodia library" is the scary part.