News for hackers. Stuff that matters.

A comment on Nokia: Yes, we decrypt your HTTPS data, but don’t worry about it. Parent comment

Re:Nokia: Yes, we decrypt your HTTPS data, but don’t worry a... by elemeno on Thursday January 10, 2013 @06:34PM (#5040427)
It's pretty standard for corporate proxy servers - at least in financial companies where theres regulations that tend to require some level of monitoring of external communications.

It's a simple MITM attack, where the endpoint (your browser) has a whitelisted certificate for the proxy, so the browser is happy that it's talking to a correctly signed certificate that it trusts, and the proxy uses the the certificate for the other end of the connection.

[ Parent | on HN ]
Re:Nokia: Yes, we decrypt your HTTPS data, but don’t worry a... by cwb71 on Thursday January 10, 2013 @09:45PM (#5041066)
One provider of "next-generation" firewalls that do this is Palo Alto Networks:

http://www.paloaltonetworks.com/products/features/decryption...

It works for SSH too, if you are not careful about host keys and fingerprints.

[ Parent | on HN ]
Re:Nokia: Yes, we decrypt your HTTPS data, but don’t worry a... by richardwhiuk on Thursday January 10, 2013 @06:37PM (#5040439)
Actually corporate proxy servers generally use CONNECT to allow HTTPS through.
[ Parent | on HN ]
Re:Nokia: Yes, we decrypt your HTTPS data, but don’t worry a... by idlecool on Thursday January 10, 2013 @06:46PM (#5040486)
and what is that?
[ Parent | on HN ]
Re:Nokia: Yes, we decrypt your HTTPS data, but don’t worry a... by carey on Thursday January 10, 2013 @07:05PM (#5040556)
Wikipedia describes it briefly at http://en.wikipedia.org/wiki/HTTP_tunnel#HTTP_CONNECT_Tunnel.... The most recent standard for it appears to be RFC 2817 section 5.2, http://tools.ietf.org/html/rfc2817#section-5.2, and it’s also in the HTTPbis Semantics and Content drafts, currently at http://tools.ietf.org/html/draft-ietf-httpbis-p2-semantics-2....
[ Parent | on HN ]
Re:Nokia: Yes, we decrypt your HTTPS data, but don’t worry a... by idlecool on Thursday January 10, 2013 @07:46PM (#5040709)
thats super cool.
[ Parent | on HN ]
Re:Nokia: Yes, we decrypt your HTTPS data, but don’t worry a... by potkor on Friday January 11, 2013 @11:06AM (#5043233)
Fortunately that kind of wiretapping is a crime in most of the civilized world, finance sector employer or not.
[ Parent | on HN ]
Re:Nokia: Yes, we decrypt your HTTPS data, but don’t worry a... by idlecool on Thursday January 10, 2013 @06:46PM (#5040487)
If they are really doing it, its really bad.
[ Parent | on HN ]