Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yup you are right.


That's not true. HTTPS over insecure proxies is safe, as long as you aren't getting SSL certificate warnings (i.e. the broken lock icon, or a big red warning).

If a man in the middle proxy decrypted the content and re-encrypted it, it would be using a different public key than the one that belongs to the original website, and your browser would know immediately and warn you, probably also preventing you from even loading the page.

The proxy would have to be trusted on your computer as a Certificate Authority, at which point you've given the proxy the power to say "trust me, this public key really does belong to Google". Even then, in many browsers the certificates for common websites are pinned, so if you tried to go to gmail.com for example and a proxy was intercepting it, and was also trusted as a certificate authority, chrome would still prevent the page from loading.


I believe locally-installed certs can override cert pinning (to allow corporate DLP boxes to work, and such).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: