Hacker News Reader

Comment by georgyo | Hacker News Reader

Does this actually work and in use?

I worked on a transparent MITM proxy, a proxy that is configured in the firewall not at the application; IE applications were unaware they were using a proxy.

Simply adding the proxies CA key to the system trust store was all that was needed to make all applications, including browsers, to trust the certificates we were manufacturing.

There was no indication besides inspecting the certificate that the certificate was ours. Definitely no calls go check certificate transparency that we could see.

View on HN

If the MITM CA is installed (maybe only via Group Policy) then browsers relax their requirements for CA's. But some domains (like google) are strictly locked down to a specific set of CA's in Chrome.

Since TLS Interception is critical for some places to achieve their duties (either auditing in banking, or content filtering in schools) we will always have some kind of legit use for MITM CA boxes.

It gets slightly worse if you look at how AntiVirus generally installs CA's to do malware content filtering. Cloudflare publishes stats on what % of traffic they think has been MITM'd: https://malcolm.cloudflare.com/

Why are we okay with content filtering in schools?

In Poland where I live, parental control basically doesn't exist. Children routinely watch movies, play games and visit websites that they're theoretically not supposed to visit. Parents know about it and don't really see an issue with it. I've seen several boarding school networks, none of them had any filtering whatsoever. The only filters I've seen were on computers in IT classrooms, but nobody uses those for non class-related activities anyway. As far as I know, we don't even have a law banning selling x-rated content to minors.

different countries different morales different way of educating childen, ymmv at the outcome!

Content filtering is by no means critical and shouldn't be used at all. All it does is punish students who don't know how to use Tor. Every school I've been to besides my highschool had either no filter or a DNS or HTTPS based filter, and most students used VPN apps which are likely worse for them (spyware etc.) than not having filtering. My highschool used Fortinet which also did SNI blocking and tried to block Tor, requesting new bridges allowed me to connect. At least Fortinet quickly reclassifies false positives though.

Maybe on some browsers. I've MITM my connections on Firefox for a very long time and have never run into anything related to transparency logs. There must be some setting I have disabled in the browser. The only way I can tell that the cert is not legit is looking at the fingerprint and the only sites I run into issues with are the few still using HPKP. I've never used Chrome. Maybe Chrome checks transparency logs and submits violations?

It's not 100% related but certificate pinning (HKPK) is only enforced for CA trusted by browser. It is ignored if the leaf certificate is signed by a user-imported CA (or deployed by enterprise policies). Maybe the same applies for SCT?

It actually works and is in use, but only for CAs that are trusted by default, not ones that you or your BOFH manually add to the trusted list.

That's how it's done in corporate environments to monitor trafic.Http or https you have no privacy.

The users can see the certificate in their browser though

Reply on news.ycombinator.com