Hacker News Reader

Comment by tempay | Hacker News Reader

That's okay unless you allow users to bring there own devices, then you have users which are taught to bypass certificate errors on a daily basis.

View on HN

Sorry but I have to call BS on that. I always bring my own device and never have bypassed certificate errors. A company will either have certificates for their own apps (commonly running on specific subdomains of their own domain) or have their own internal CA that you can trust on your own device.

Certificate errors on "internal" web apps are just as bad as on the rest of the internet.

If you trust a company's internal CA then aren't you trusting them to issue certificates for every website and not just their own? Isn't that dangerous?

Yes absolutely.

If I have to I trust the company's CA in a special browser profile that I only use for working with their internal tools.

For just a few tools it's often simpler to just trust those specific certificates, though

All browsers can tell you what certificate signed the one in use. Unfortunately a recent chrome UI change made this a pain to get to.in chrome, into the other browsers just clicking on the lock in the address bar, it soon becomes obvious if the company is mitm all SSL connections.

Because a normal person will "just click the lock in the address bar" on every single HTTPS website he visits to make sure his company isn't MITMing him, right?

Reply on news.ycombinator.com