Windows SSL Interception Gone Wild

Post by ptaipale » Sat, Feb 21, 2015, 10:21 AM UTC

dredmorbius wrote: post #42

zevyoura wrote: post #28

Earlier quoted context omitted.

Yes, and they do all that with the user's consent.

Um, really? How informed is that consent? What of sites that unilaterally change rules retroactively? Or fail to provide reasonable alternatives? Facebook does all of the above. To an extent that I don't trust it, and don't use it. But there are plenty of other services which wave the "but you consented!" flag. Google comes to mind, and I've had my set of issues with them as well.

Post by pestaa » Sat, Feb 21, 2015, 10:39 AM UTC

userbinator wrote: post #62

pilif wrote: post #49

Earlier quoted context omitted.

Chrome does not warn if the non-official root certificate is custom installed on the local machine. It needs to do this because of the various corporate web filters and anti virus tools that MITM connections too. Maybe this is a practice that needs to stop. Malware scanners can scan on the local machine after the browser has decrypted the communication and web filtering, I think, is nothing but a sign of mistrust aga…

web filtering, I think, is nothing but a sign of mistrust against the users. What if it's the user who wants this filtering? I run a local proxy that MITMs to filter out ads, tracking scripts, and other undesirable things. It works in all the browsers I use regularly, and any browsers that happen to be embedded in apps, because this way the stuff I want filtered out never even reaches the browser.

Post by chinathrow » Sat, Feb 21, 2015, 10:51 AM UTC

pilif wrote: post #49

GauntletWizard wrote: post #47

Earlier quoted context omitted.

(3) Google; Chrome has a rather sophisticated mechanism for detecting MITM attacks, in that it's distributed with pinned certs for several Google properties, and phones home with reports of errors it receives. This is how the DigiNotar leak[1] was discovered. Perhaps because it was persistent and on the TCP stack level the phonehomes never succeeded? The retry logic should be robust enough to try to deliver the fraud…

Chrome does not warn if the non-official root certificate is custom installed on the local machine. It needs to do this because of the various corporate web filters and anti virus tools that MITM connections too. Maybe this is a practice that needs to stop. Malware scanners can scan on the local machine after the browser has decrypted the communication and web filtering, I think, is nothing but a sign of mistrust aga…

Post by chinathrow » Sat, Feb 21, 2015, 10:54 AM UTC

logn wrote: post #39

ProAm wrote: post #36

Earlier quoted context omitted.

Can browser plugins install root CA certs? Honest question, Im not sure but I would be surprised if they could?

You can write anywhere to disk where user has privileges (at least in FF). Not sure if that's enough. But I don't think you need a CA at all since plugins can see the full DOM (whether SSL or not). Like if you "inspect element", view source, or run firebug. The plugin is already written too: https://addons.mozilla.org/en-US/firefox/addon/windowshopper...

Post by josteink » Sat, Feb 21, 2015, 11:07 AM UTC

GauntletWizard wrote: post #47

jgwest wrote: post #22

I think it's interesting that this BADWARE install was found more or less accidentally... apparently by some tech dude noticing that his bank login presented a Silverfish-issued CA cert. Shouldn't the possiblity have been forseen and addressed beforehand? Perhaps by... (1) Anti-virus / anti-malware makers. Does this software not notify the user when strange CA certs are put into a system's root certificate storage? I…

(3) Google; Chrome has a rather sophisticated mechanism for detecting MITM attacks, in that it's distributed with pinned certs for several Google properties, and phones home with reports of errors it receives. This is how the DigiNotar leak[1] was discovered. Perhaps because it was persistent and on the TCP stack level the phonehomes never succeeded? The retry logic should be robust enough to try to deliver the fraud…