Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #192609

SSL inspection

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Reco:

> Browsers do certificate validation, "wrong IP address" would be 
> possible if the third party somehow produced a valid certificate for 
> wiki.debian.org (you have to be a CA *or* the government to do this) 
> and faked a DNS record (that's easy part).
>
One can also do it if one is the person's employer and owns the machine 
that the employee is running, no DNS resource record modifications 
required, merely the employer as an additional root authority pushed out 
via group policy or suchlike and either custom proxy auto-configuration 
or transparent proxying at the borders.  This has been a known practice 
for many years, and there have been for that time a wide range of 
products sold to employers for specifically doing this.

* https://technet.microsoft.com/en-gb/library/ee658156.aspx

* http://cookbook.fortinet.com/why-you-should-use-ssl-inspection/

* https://securebox.comodo.com/ssl-sniffing/ssl-inspection/

* https://www.zscaler.com/products/ssl-inspection

* https://www.globalsign.com/en/blog/what-is-ssl-inspection/

... and so on.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-16 03:10 +0100
  Re: wiki Andy Smith <andy@strugglers.net> - 2018-02-16 05:30 +0100
  Re: wiki rhkramer@gmail.com - 2018-02-16 12:50 +0100
    Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-16 13:10 +0100
      Re: wiki Richard Owlett <rowlett@cloud85.net> - 2018-02-16 14:10 +0100
      Re: wiki Greg Wooledge <wooledg@eeg.ccf.org> - 2018-02-16 16:40 +0100
        Re: wiki Gene Heskett <gheskett@shentel.net> - 2018-02-16 17:30 +0100
        Re: wiki Andy Smith <andy@strugglers.net> - 2018-02-16 18:00 +0100
          Re: wiki Brian <ad44@cityscape.co.uk> - 2018-02-16 19:00 +0100
        Re: wiki Reco <recoverym4n@gmail.com> - 2018-02-16 18:00 +0100
          Re: wiki Gene Heskett <gheskett@shentel.net> - 2018-02-16 18:10 +0100
          SSL inspection Jonathan de Boyne Pollard <J.deBoynePollard-newsgroups@NTLWorld.COM> - 2018-02-18 08:50 +0100
            Re: SSL inspection Reco <recoverym4n@gmail.com> - 2018-02-18 09:40 +0100
          Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-19 03:40 +0100
            Re: wiki Roberto C. Sánchez <roberto@debian.org> - 2018-02-19 03:50 +0100
              Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-19 06:50 +0100
            Re: wiki Reco <recoverym4n@gmail.com> - 2018-02-19 06:20 +0100
              Re: wiki Curt <curty@free.fr> - 2018-02-19 12:10 +0100
                Re: wiki Reco <recoverym4n@gmail.com> - 2018-02-19 13:00 +0100
              Re: wiki Rodary Jacques <rodaryj@free.fr> - 2018-02-20 00:30 +0100
      Re: wiki Gene Heskett <gheskett@shentel.net> - 2018-02-16 16:40 +0100
  Suggest contacting wiki@debian.org - was [Re: wiki] Richard Owlett <rowlett@cloud85.net> - 2018-02-19 13:00 +0100
    Re: Suggest contacting wiki@debian.org - was [Re: wiki] Brian <ad44@cityscape.co.uk> - 2018-02-19 13:40 +0100
      Re: Suggest contacting wiki@debian.org - was [Re: wiki] Steve McIntyre <steve@einval.com> - 2018-02-19 14:30 +0100

csiph-web