Hacker News Reader

Comment by TazeTSchnitzel | Hacker News Reader

The Superfish proxy accepts any certificate. If you're being MITMed (before Superfish MITMs you), Superfish will help them by replacing their certificate with Superfish's.

View on HN

I don't believe that's true, but if so – for example if it replaces self-signed certs, or certs from any untrusted CA, with its own (force-trusted) cert – then that would be worthy of another scary explicit bullet point.

(It might just accept all CAs locally-configured, and it's accepting its own because they didn't special-case a rejection.)

It is true. I can't remember where I read it, but I remember seeing it either here on HN or on Twitter.

Komodia's own info says that it will generate an invalid certificate if the real certificate was invalid or untrusted "so it will not cause a security problem". They may be lying, but that page is fairly open about the way it works:

http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cer...

I wouldn't go as far as say lying, they just failed to consider the SAN. Unfortunately they pulled the doc, possibly due to what they claim to be a DDOS but it's still in Google cache:

http://webcache.googleusercontent.com/search?q=cache:XUbVSX8...

'SAN'?

http://en.wikipedia.org/wiki/SubjectAltName

SubjectAltName.

It's TRUE, confirmed, and replicated by others. See my other post to this parent. And you are correct, this is worthy of another scary explicit bullet point!

Reply on news.ycombinator.com