Hacker News Reader

Comment by jimktrains2 | Hacker News Reader

MITMing TLS requires either (1) a falsely issued certificate, which would be "a big deal" when (not if) found and would lead to the issuer losing their status as accepted in browsers, or (2) the user to install a certificate generated by the person doing the MITM, this is often done in corporate environments.

View on HN

> or (2) the user to install a certificate generated by the person doing the MITM

You mean like that "setup software" Comcast spent ages trying to pretend I had to install just to get things running?

I ran Linux in those days, which always meant a little extra support time but I never had to install jack.

That's quite possible, but many apps and browsers pin certificates and this would probably be reported quickly?

https://chromium.googlesource.com/chromium/src/+/master/docs...

> Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites.

I was going off remembering this.

> Late on December 24, Chrome detected and blocked an unauthorized digital certificate for the "*.google.com" domain.

https://security.googleblog.com/2013/01/enhancing-digital-ce...

Pretty sure chrome has it's own code to detect Google certs and report invalid ones back to Google.

Are we sure that there won't be an exception installed to this in favor of broadband providers, considering the paths already taken?

Terms and conditions of this comment: This comment is provided for free to <https://news.ycombinator.com> AKA "Hacker News", including any redistribution to be considered under the clause of fair use. Any other redistribution, including injection of third party content or surrounding content, chrome, or any other HTML element(s), be it in static or generated code, is considered a violation of the terms of this contribution.

Your browser and OS quickly delist any certificate found to have forged a certificate for a website they don't own. They're unapologetic about it too - and don't care who they piss off.

However, browsers have played along with US legislation previously. (E.g., when long key encryption was restricted to US versions only.) I'm not sure, if Mozilla would be playing along nowadays, but you can't be too sure, either. Moreover, you could consider certificates installed by antivirus software as some kind of prior art to this. (While considered a security risk, at least by some, they are not delisted.)

Antivirus ones generate the root certificate on your machine.

As may do installer software shipped by the ISP (mandatory or incentivized by cloud storage, etc.)

Reply on news.ycombinator.com