News for hackers. Stuff that matters.
Re:Chrome 68 will mark all HTTP sites as “not secure” by fiddlerwoaroof on Thursday February 08, 2018 @10:03PM (#16337592)
Of course, this is a feature in certain contexts: I’d love to be able to inspect all the traffic going in and out of my home network and possibly even modifying it at the edge device.
Re:Chrome 68 will mark all HTTP sites as “not secure” by MaulingMonkey on Thursday February 08, 2018 @10:19PM (#16337669)
Try fiddler.

I've inspected my own HTTPS traffic a number of times using it including e.g. traffic from e.g. iPads where my Desktop was effectively acting as "the edge device". Of course, this is more for debugging than aggregate statistics/monitoring...

This won't let you inspect traffic secured via certificate pinning without additional reverse engineering to figure out how to replace the pinned cert, but it'll work fine for vanilla HTTPS / generic CA based stuff (e.g. all browser traffic.)

Re:Chrome 68 will mark all HTTP sites as “not secure” by IncRnd on Thursday February 08, 2018 @11:23PM (#16337874)
> This won't let you inspect traffic secured via certificate pinning without additional reverse engineering to figure out how to replace the pinned cert

Replacing a cert doesn't get around cert pinning. That is the exact use case that cert pinning protects against.

Re:Chrome 68 will mark all HTTP sites as “not secure” by tzahola on Friday February 09, 2018 @03:27AM (#16338739)
They meant replacing the cert fingerprint in the app that’s using cert pinning.
Re:Chrome 68 will mark all HTTP sites as “not secure” by IncRnd on Friday February 09, 2018 @09:44PM (#16345555)
That makes sense. Thank you.
Re:Chrome 68 will mark all HTTP sites as “not secure” by fiddlerwoaroof on Friday February 09, 2018 @10:16AM (#16340748)
Couldn’t a mitm proxy just strip out the relevant headers?
Re:Chrome 68 will mark all HTTP sites as “not secure” by IncRnd on Friday February 09, 2018 @09:40PM (#16345545)
It appears you're talking about pinning in browsers only, so I'll address from that perspective only.

For public certs: Yes, but that would only produce the desired effect if the site hadn't yet been pinned, and this was a first connection, or in the case of the pins having expired. In other words, the pinning can only be stripped out if there is no pinning already in place on the client.

However, this will soon be a moot point, as Chrome removes pinning in favor of cert transparency. This will reopen this security hole in browsers simply trying to be secure within captive portals and other insecure networks. Tor has pinning that would extend from inside the portal to outside, so that may be one option, but I don't yet know how sturdy that is.

Re:Chrome 68 will mark all HTTP sites as “not secure” by andrewaylett on Friday February 09, 2018 @06:01AM (#16339330)
Firefox at least will disable pinning if it sees a certificate signed by a user-supplied CA, on the one hand to facilitate this kind of debugging and on the other because otherwise enterprises using MITM boxes wouldn't be able to use Firefox. I suspect Chrome does too.
Re:Chrome 68 will mark all HTTP sites as “not secure” by detaro on Friday February 09, 2018 @06:03AM (#16339335)
Yes, all major browsers do that.