Life Is About to Get Harder for Websites Without HTTPS

Re:Life Is About to Get Harder for Websites Without HTTPS by wfunction on Wednesday July 12, 2017 @03:49AM (#14750854)

If you trust a company's internal CA then aren't you trusting them to issue certificates for every website and not just their own? Isn't that dangerous?

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by bjpbakker on Wednesday July 12, 2017 @04:22AM (#14750967)

Yes absolutely.

If I have to I trust the company's CA in a special browser profile that I only use for working with their internal tools.

For just a few tools it's often simpler to just trust those specific certificates, though

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by ewanm89 on Wednesday July 12, 2017 @08:50AM (#14752036)

All browsers can tell you what certificate signed the one in use. Unfortunately a recent chrome UI change made this a pain to get to.in chrome, into the other browsers just clicking on the lock in the address bar, it soon becomes obvious if the company is mitm all SSL connections.

[ Parent | on HN ]

Re:Life Is About to Get Harder for Websites Without HTTPS by wfunction on Wednesday July 12, 2017 @08:57AM (#14752079)

Because a normal person will "just click the lock in the address bar" on every single HTTPS website he visits to make sure his company isn't MITMing him, right?

[ Parent | on HN ]