Hacker News Reader

Comment by shawkinaw | Hacker News Reader

> So this very much looks like evidence of an active system-wide certificate pinning mechanism protecting against MITM attacks on high-value Microsoft domains. Which, per se, is a good thing!

I feel like a broken record, but no, if you can't turn this off, it is not a good thing! It means you can never use an HTTPS proxy and know exactly what data is streaming off of your computer.

View on HN

Indeed, a "MITM attack" is a good thing if you are the one inspecting the data.

Obligatory story about having control over your computing enviroment: https://www.gnu.org/philosophy/right-to-read.en.html

You can, you just need to have someone reverse engineer the pinning mechanism first to figure out how to disable or bypass it, or alternatively, log the data being wrapped in TLS. Same as has been done on mobile platforms (e.g. HttPeek for iOS).

Given that products like Fiddler still work against live.com domains on Windows 10, either the pinning isn't enabled, Fiddler knows how to bypass it, or this isn't actually related to pinning.

Or maybe the pinning isn't for IE, but for Windows sending MS hidden information it doesn't want you to know about.

That's an awfully large list of domains for "hidden" telemetry. Hard to imagine why all of those would be specified for that. e.g. Some of those are just landing pages.

Disclosure: Microsoft employee

You can be pretty sure they collect everything that is technically possible at scale. And that there is a back-door to your system in case they need any details. It feels good that they use encryption though. <sarcasm>

Reply on news.ycombinator.com