Re:.INTERNAL is now reserved for private-use applications
by the8472 on Saturday August 10, 2024 @07:15AM
(#41208716)
To inspect your own traffic you can use SSLKEYLOGFILE and then load it into wireshark.
[ Parent
| on HN ]
Re:.INTERNAL is now reserved for private-use applications
by tsimionescu on Saturday August 10, 2024 @08:07AM
(#41208907)
Most apps don't support SSLKEYLOGFILE. OpenSSL, the most popular TLS library, doesn't support it.
Re:.INTERNAL is now reserved for private-use applications
by haradion on Saturday August 10, 2024 @02:14PM
(#41211234)
OpenSSL does provide a callback mechanism to allow for key logging, but the application does have to opt in. IIRC, at least Curl does support it by default.
Re:.INTERNAL is now reserved for private-use applications
by tsimionescu on Saturday August 10, 2024 @04:37PM
(#41212039)
Yes, there are ways to do keylogging with OpenSSL. Even if the app doesn't support it, you can do it with LD_PRELOAD and external libraries that call those callbacks. But it's still a whole lot more work than just an env var, and then just not having all these problems in the first place, by avoiding unnecessary encryption. And it probably won't work on mobile.