Hacker News Reader

Comment by LanternLight83 | Hacker News Reader

I would absolutely love to have control over HTTPS traffic on my network, specifically to enable my Squid proxy to cache HTTPS pages, but unfortunately not every device or even program supports custom CA's. I'd be the man-in-the-middle between the internet and every device I own.

View on HN

You don’t need to MitM. Squid can use SNI to allow whitelisted hosts, for now at least.

Hopefully that will be fixed with widespread usage of TLS ESNI/ECH

I think that is a pretty user-hostile attitude and I suspect you probably wouldn't really love it if every network operator was doing that kind of thing.

What’s user-hostile is every consumer device insisting on pushing its defaults and ignoring any network policies I’ve configured.

Yes, I agree that is also user-hostile, since it should be configurable. The problem is not about network policies though, since DHCP is explicitly not designed to be a policy and is purposely meant to be optional for the client.

For this reason I wouldn't recommend buying a device like the Chromecast, in which the user can't configure the network settings. Instead maybe consider something like the Amazon Fire Stick which is not as user-hostile.

I read that as LanternLight83 is both the network operator and the user in this case, and if so it’s not really a problem.

I would also love to MitM myself in some cases, mostly because it’d be interesting to see what’s going on.

Yes, but my point is that if you feel it's justified for your own network then you ought to expect every other network operator will feel that way about their network too.

So before applying that mentality, it would be wise to consider what your experience would be like if all your neighbours, friends, colleagues etc also did that on their networks.

I have no problem with that: if my workplace MITMs traffic, I’ll use my cellphone connection and a personal laptop for sensitive data. If a friend’s house mitms traffic, same deal.

Is the point that I sometimes use these networks? Then I somewhat agree - I would set up a separate guest network without shenanigans for guests to use. This avoids both the ethical sketchiness and having to explain why their web browser is shouting at them

True, that could be a good compromise. Although there are still some disadvantages like creating an SPoF for yourself and increasing your attack surface (e.g. anyone who compromises your internal CA has access to all your encrypted connections)

Reply on news.ycombinator.com