News for hackers. Stuff that matters.

A comment on The Power to Revoke Lies with the Certificate Authority. Parent comment

Re:The Power to Revoke Lies with the Certificate Authority by regecks on Friday April 27, 2018 @03:03AM (#16938937)
I did a contract in a corporate environment where the SSL interception proxy passed-through any site with an EV certificate.

I first noticed that it wasn't intercepting my connection to my bank, and then after some experimentation, that turned out to be the pattern. Sounds stupid, but there you go, somebody uses EV as a signal for something.

[ Parent | on HN ]
Re:The Power to Revoke Lies with the Certificate Authority by crdoconnor on Friday April 27, 2018 @10:03AM (#16940814)
You made me curious - I work at a company that does that.

As it turns out it appears to intercept everything except connections to major high street banks.

[ Parent | on HN ]
Re:The Power to Revoke Lies with the Certificate Authority by gruez on Friday April 27, 2018 @01:11PM (#16942427)
I wonder whether they're doing it by IP, DNS, SNI, or certificate. because if it's by SNI or DNS, it's pretty easy to get pass the intercepting proxy.
[ Parent | on HN ]
Re:The Power to Revoke Lies with the Certificate Authority by crdoconnor on Friday April 27, 2018 @01:18PM (#16942475)
It's by certificate although the company does run an HTTP proxy for techies that doesn't MITM certs.

These days I can't be bothered to circumvent. If I want to do any sort of sensitive browsing at work (e.g. online banking) I just tether my laptop to my phone.

[ Parent | on HN ]