Hacker News Reader

Google Chrome defers to the local PC for installed certificates. So, cert pinning didn't protect users at all in this instance.

It's a 'feature' of Chrome so that it will use an installed corporate SSL and allow intentional MitM of all HTTPS traffic for purposes of institutional eavesdropping.

View on HN

There are some very important uses of such institutional eavesdropping, such as running an intrusion detection system on a corporate network; I'd argue that this is a worthy tradeoff between employee privacy and good information security.

You've undermined both if your proxy is powered by Komodia or another product with similar flaws. What if you've hardened your workstations, but your proxy client supports inferior ciphers? All that work is undone. What if your proxy is easily fingerprinted? That's valuable information to an attacker. There are so many details to get right, and it can take years to discover the flaws that can be exploited by an attacker poking in the right places.

It's not necessarily for institutional purposes.

I use it to view my own https traffic in Fiddler.

Reply on news.ycombinator.com