Hacker News Reader

Qs: to those who are running a MITM proxy

Is there no risk running an MITM proxy, even if self hosted, that can see all your financial and other important private communication?

I know a couple mentioned here are open source, but are they guaranteed to be safe? How do I know which one (s) are good to use and can be trusted.

I want to rub it based on this thread, but have the above concern.

View on HN

I can answer this as one of the mitmproxy devs: We're doing this for 10+ years as FOSS, we're a relatively well-known project (so lots of eyes hopefully), our software has absolutely zero telemetry / phone home functionality, and we're developing under our real names. We also have relevant backgrounds in either the security industry and academia, and absolutely no plans to monetize mitmproxy.

Does that make it guaranteed to be safe? Not really. I'd personally trust our TLS stack over most IoT TLS implementations, but Chrome/Firefox/Safari will do a better job at e.g. revocation checking. That being said, I'd argue that this is unlikely to be the weakest link in your threat model.

If your root CA private key is compromised, there's a risk that a threat actor could generate certificates that your device will trust for any domain.

MITMProxy is a pretty well known and trusted open source project, but I wrote my own proxy to keep Apollo alive.

Reply on news.ycombinator.com