Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

They can't buy and configure an HTTPS proxy? Those things do exist after all.


HTTPS proxies work less well today than they did even five years ago. Certificate pinning and other security improvements have broken a lot of things (by design).

So the question is: What is more important, allowing HTTPS proxies, or stopping governments with a CA from MitM-ing traffic (e.g. Iran, China, etc).

A nice compromise might be to inform users that they're being MitM-ed by an installed CA, but only once and subtly so.


Which browsers enforce pinning when faced with a CA proxy? Chrome explicitly overrides pinning in this case, so they don't break half of all corporate usage.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: