Hacker News Reader

Comment by loeg | Hacker News Reader

Fwiw, my employer (large East coast USA software firm) also MITMs Github (and the rest of HTTPS, excluding a small whitelist). Their MITM software doesn't even bother to validate the certificates on their side of things, where it is possible. It is … not very awesome.

View on HN

Is that to discourage employees from working on personal projects at the office, and/or to discourage them from sending company-owned code outside their corporate network?

More the latter. It's probably impossible to stop all encrypted traffic that you can't look at, but you can make it harder for people to do it by stupid or by malware.

OP here. Actually, their logic is that this way they can scan files for viruses (not kidding). (E.g., from gmail attachments.)

This happens at other employers as well; same general rationale.

> and/or to discourage them from sending company-owned code outside their corporate network?

> More the latter

Sooooooo I guess employees have to resort to the old "micro SD card in your shoe" technique...

Or just use a tunneling proxy.

Yes, getting around it is easy. It's just obnoxious, and adds latency, and application support for SOCKS is shitty, and …

I guess I could set up OpenVPN on a VPS or something.

Just curious what the whitelist is... Chrome's pinned certs? That's always a point of curiosity for me: no one knows what Chrome is sending to Google.

Chrome's pinning logic is disabled for connections where the signing cert was added to the trust store by a user, I think largely in part to avoid breaking these type of corporate MITM proxies.

So if you want to watch the traffic, it should be as simple as MITMing yourself with a cert you add to the Chrome trust DB.

I don't want my corp firewall spying on net traffic, so I don't add them to the trusted CAs DB.

It would be slightly more palatable if the firewall did cert validation on the other side of things… but they don't.

No, they MITM google as well as everyone else. The whitelist includes yelp, for some reason... not really sure what else. I definitely do not add their MITM CA as a trusted root in my browser...

Reply on news.ycombinator.com