Hacker News Reader

"It is in fact quite possible – and quite common – for a firewall or other device in your network path to terminate your TLS connection with a website and then re-create a TLS connection from the device to your browser." https://www.internetsociety.org/resources/deploy360/dane/

Isn't it then possible, albeit harder to do a MITM attack at this point with HTTPS?

View on HN

If you've decided that you trust the "firewall or other device", perhaps because you purchased it, or because doing so is a condition of employment, then you get to keep both halves.

If the "firewall or other device" tries to interpose when you don't trust it, that won't work, for the same reason it doesn't work for bad guys. We do not distinguish the apparent reason for attempts to destroy the confidentiality, integrity or authenticity promises in TLS, whatever the apparent motive your HTTP transaction will either work, delivering those promises or you get an error and no progress is made.

Reply on news.ycombinator.com