Hacker News Reader

Comment by JoshTriplett | Hacker News Reader

> I, as the user, want to override HPKP, it should be easy for me to do so.

Absolutely. For debugging purposes, browsers should have a mechanism where you can purposefully use your own local certificate, with a big unremovable warning at the top telling you that. It should not, on the other hand, ever look like a valid secure site.

No legitimate reason exists for a browser to silently show a site as secure that uses certificate pinning and doesn't serve the pinned certificate. Ever. For debugging purposes, you don't need it to work silently.

And if someone started intentionally compromising browsers to make such warnings go away, we'd have a clearer indication that they'd progressed past ignorance into malice.

View on HN

I've heard that some corporate networks do this to enable filtering and monitor employee internet usage. I could see that being a somewhat legitimate use case.

So you don't think that the corporate employees have the right to know then their company is doing MITM to monitor their HTTPS traffic?

I guess if you're using a company's computer on that company's network, assume it's their best interest to monitor some of the stuff.

They can monitor, that's fine, and the correct/ethical thing would be to inform the employees about it and show them a little thing in Chrome to indicate they're being monitored.

Informed consent, in other words.

pdkl95 also makes excellent point about the current default behavior being the problem: https://news.ycombinator.com/item?id=10630375

We could argue over whether that qualifies as "legitimate", but in any case that doesn't require doing it silently and showing sites as secure. Browsing on such a network should show persistent warnings about every site whose traffic appears potentially intercepted. You can then knowingly continue browsing on that network if you consider it legitimate.

A corporate network (or any other end user) should have no trouble enabling some sort of explicit override option. Having the ability to override certs is fine; the problem is that it's default behavior.

Dell would (hopefully) be a lot more reluctant to ship one of these certs and show specific intentions by changing settings to allow this kind of override.

Palo Alto Networks firewalls do exactly that. It was one of their big differentiating feature; this is the main reason companies buy them.

Personally I agree with you, but PANW has 15.62 billion reasons to disagree with us. I suspect Google's position is to placate companies like PANW and their customers.

I eagerly await the point where we finally start treating the generation of MITM certificates by any CA as immediate grounds for permanent revocation by all browsers.

Reply on news.ycombinator.com