Re:Microsoft is phoning home the content of your PowerPoint ...
by kccqzy on Monday November 07, 2022 @11:32AM
(#33508057)
A well-designed OS API doesn't need to do MitM and therefore would work with HSTS or cert pinning enabled.
Of course for obvious reasons, few commercial apps would actually use this API unless they have some other incentive.
Re:Microsoft is phoning home the content of your PowerPoint ...
by 3pt14159 on Monday November 07, 2022 @11:38AM
(#33508150)
Well, the original article was about Microsoft. Since they're the OS vendor too, I discounted that as being reliable for this use-case.
Re:Microsoft is phoning home the content of your PowerPoint ...
by Acinyx on Monday November 07, 2022 @11:33AM
(#33508063)
Any application that uses certificate pinning would fail in this situation as that's specifically what it is trying to prevent.
Re:Microsoft is phoning home the content of your PowerPoint ...
by moviuro on Monday November 07, 2022 @11:48AM
(#33508328)
You "just" need the key to the encrypted traffic. You don't have to change the handshake/negotiation, you just want a copy of the key so you can decrypt the traffic.
In TLS, the client authenticates server, then they both agree to use a key for the session; the OS can get a hold of this key (this is usually a bad move because then any captured traffic frames could be later decrypted).
I'm not sure of that. Provided you can add a cert to your OS, you should be able to get away with a piece of protocol downgrade network gear that you can then pipe to a different (ideally, offline other than UDP receive) computer for analysis.
You'd need to disable HSTS, but other than that I think it should be the solution you're looking for. Oh, and for good measure, ethernet cable instead of wifi.