Hacker News Reader

Comment by jtchang | Hacker News Reader

Suppose you visit https://mail.google.com/ from inside a corporate network.

Assuming ideal scenarios no one can snoop on your traffic between you and Google because of SSL.

If a company wants to monitor you they have lots of options. One option is to try and record all traffic between you and Gmail. However if the try to do that your web browser will pop up a warning saying mail.google.com is pretending to be someone else.

To get around this a company can create fake certificates that are trusted by your browser. Then they need to intercept the traffic and basically pretend they are gmail all the way recording you.

Ignoring the fact that companies already have a lot of rights to snoop on whatever you do this is just bad precedent.

View on HN

Or they can provide default VMs which have a company certificate as a trusted root, either locally or in the Active Directory. Then it's simply a intercept and dump without the browser complaining. (I cannot confirm the active directory problem in other browsers apart from IE)

See dektz's reply. Companies create their own CA cert (you can do that using e,g. openssl) and use domain policies to install it on every machine they control. Then they can setup a proxy that takes the CA cert and dynamically generates certs for each domain that is accessed over HTTPS (Squid can do that).

So this article is suggesting that this practice is wrong and will not be tolerated or that the root CA authorities should not be the ones to generate the certificates?

No.

There is nothing wrong with creating your own CA root certificate and installing it on computers you use. People do this all the time. For instance, web testing proxies all synthesize a fake CA root cert, because otherwise they wouldn't be able to run tests against HTTPS sites.

What happened here was, a company didn't want to go through the (significant) bother of installing something in thousands of computer systems. So they did an end run around the system and got a complicit CA to in effect add them to the global Internet CA root system, which they had no business being a part of. Since the certificate they minted in this process appeared to browsers to be a real, signed, chained-from-the-roots CA=YES cert --- something nobody can make for themselves, not being able to do that being the whole point of SSL/TLS --- they didn't have to install anything. On any computer. Anywhere on the Internet.

Interestingly, Chrome and Gmail do strange things when you MITM attack them. Try enabling Charles Proxy and watch all he requests to securebriwsing.Google.com.

Reply on news.ycombinator.com