News for hackers. Stuff that matters.

A comment on Maintaining Digital Certificate Security. Parent comment

Re:Maintaining Digital Certificate Security by djrogers on Monday March 23, 2015 @07:12PM (#9253920)
> Users of MCS traversed that proxy to get to Google, at which point the proxy dutifully generated a (fake) Google certificate to bypass TLS for that connection. Google noticed.

I'm curious about the mechanism of Google noticing - was Chrome side-channeling information about it's cert to Google? Because if it was a true MITM proxy, google would never have talked to the browser directly to know what cert the browser was being presented. That's kinda how the whole MITM thing is dangerous - it's invisible to both sides if done correctly...

[ Parent | on HN ]
Re:Maintaining Digital Certificate Security by mdavidn on Monday March 23, 2015 @07:24PM (#9253965)
Chrome ships with a list of CAs allowed to issue Google certificates. If Chrome encounters a Google certificate signed by some other root authority, it phones home.

http://blog.chromium.org/2011/06/new-chromium-security-featu...

[ Parent | on HN ]
Re:Maintaining Digital Certificate Security by iancarroll on Monday March 23, 2015 @07:21PM (#9253949)
Google Chrome automatically reports back to Google if a certificate appears for Google and it is not issued by Google's own intermediary. It also blocks it from ever loading via HPKP.
[ Parent | on HN ]