Comment by jgraham | Hacker News Reader

Comment by jgraham | Hacker News Reader

Parent Full thread

> Browser vendors need to rethink the mostly blind eye they've been turning toward corporate DPI and silent MITM.

It is unclear to me if browser vendors could actually do anything meaningful here. After all a sufficiently motivated company could just deploy a private fork of an open source browser with any code changes they want. No doubt, if there is demand, someone would be happy to sell pre-customised versions of these browsers. The only restriction they would have is that they couldn't call the result "Firefox" or "Chrom[ium]", but since they set the IT policy, requiring all employees to use FooCorp Internet Browser isn't a problem. I guess the trademark issue, but really only the trademark issue, does make that approach less viable for adding MITM "capabilities" to OEM-distributed browsers.

(note: I work for Mozilla, but am not a security expert)

I actually think reframing these issues as something that might necessitate a fork for corporates could be good for all involved because that hopefully would mean less egg on Mozilla's face when someone finds out they're being DPIed.

There's a lot more nuance than I've acknowledged, but I'd much rather people make a fairly consistent set of assumptions about the trustworthiness of Firefox and a second, different set of assumptions about corporate MITMfox.

Even though I'm not a fan of it, I also recognize that companies own their assets and need to protect their networks. But should Firefox stay completely quiet by default when an IT department MITMs an employee's traffic? Even if we all acknowledge the same IT department could turn those warnings off, I think it would still be a start.

This will always be a cat-and-mouse game and I agree that Mozilla may not be able to permanently 'win' on behalf of users, but I think browser vendors in general could do more to shift norms and change the 'framing' of whether users see (for example) a monkey-in-the-middle icon instead of a lock icon by default when they're being MITMed by adware or corporate DPI.

Reply on news.ycombinator.com