News for hackers. Stuff that matters.
Re:EFF's HTTPS Everywhere Firefox plugin by jodrellblank on Friday June 18, 2010 @12:55AM (#1441380)
Just because it surprised me to find it - firewalls we deal with have HTTPS MITM capability built in. You install an SSL certificate which your corporate workstations trust, and it will present that to the workstation while proxying the connection out to the site, and sniffing/filtering the traffic in between.

Until I saw that I thought of it as 'an attack'.

Re:EFF's HTTPS Everywhere Firefox plugin by colonelxc on Friday June 18, 2010 @03:55AM (#1441620)
I still consider it an attack.

There's lots of security reasons why a company would want to do that, both in protecting from malware and protecting from loss of company IP. Still, a huge trade off between privacy and security, and I am not willing to make that trade.

Maybe I would do it on my own connection, where I was both the MITM'er and the "victim", but the whole ssl system is built upon trust. It's a shaky foundation (do you trust all of the root certs in your browser?), but let's not start poking holes everywhere in it.

Re:EFF's HTTPS Everywhere Firefox plugin by agl on Friday June 18, 2010 @10:31AM (#1442312)
I'd be interested to know the manufacturer of these devices and how prevalent they are. (p.s. you're welcome to email me rather than do that in public: append @google.com to my username.)

Cheers