Re:Why are free proxies free? (2013)
by nothrabannosir on Sunday January 04, 2015 @08:30AM
(#8834339)
Mainstream browsers do not readily support HTTPS connections to proxies. FF only very recently introduced this, Chrome needs you to specify the proxy URL on the command line.
Even when you do, the connection to the proxy being HTTPS has nothing to do with the "https://" you see in the browser.
Bottom line: do you see a green "https://...google.com/..." ? Then you are safe. SSL stripping will NOT go undetected, without compromising your computer in some way (fake root CA).
For more info, search the net for SSL strip tools and look at their features. E.g.: homograph domain names, rewriting https:// links to http://, or using self-signed CAs (will cause SSL warning). If you find a real, clean SSL strip, make sure to post it here to HN. Guaranteed you will make the front page ;)
Even when you do, the connection to the proxy being HTTPS has nothing to do with the "https://" you see in the browser.
Bottom line: do you see a green "https://...google.com/..." ? Then you are safe. SSL stripping will NOT go undetected, without compromising your computer in some way (fake root CA).
For more info, search the net for SSL strip tools and look at their features. E.g.: homograph domain names, rewriting https:// links to http://, or using self-signed CAs (will cause SSL warning). If you find a real, clean SSL strip, make sure to post it here to HN. Guaranteed you will make the front page ;)