[semenko]

Chrome does do pinning, but ignores pins when the cert parent is a privately installed cert (because this is a "feature" used by many enterprises).

"""

Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor.

A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites.

'Data loss prevention' appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning.

"""

See: http://www.chromium.org/Home/chromium-security/security-faq#...

[kinofcain]

And the rationale:

"We deem this acceptable because the proxy or MITM can only be effective if the client machine has already been configured to trust the proxy’s issuing certificate"

I think that's fair, or at least it has traditionally been a fair assumption for most users.

The issue here is that your hardware vendor has compromised your machine, so that is no longer a fair assumption.

[MichaelGG]

Well continue the process. Suppose Chrome did flag such things. That'd break a lot of "legitimate" use cases, and someone would implement a workaround. For instance, they could just patch the Chrome binaries to disable the warnings or change the pinning logic. Insert their own certs into the pin list. Without something like Intel SGX, you or Google can't totally win.

Of course, Chrome could give some indication like a lock+eyeball or something, and hope the interception vendors are too lazy to bother modifying the code. They could also only disable warnings if the machine is connected to a domain or other management system.

[cesarb]

There's another issue with ignoring cert pining with user-added root certificates: if you add a root certificate that's missing on your client machine (for instance CAcert or your national CA like ICP-Brasil), the CA you added can bypass pining, even though it shouldn't be able to.

On Mozilla, you can configure it to never bypass pining (security.cert_pinning.enforcement_level set to 2, see https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn... ); I don't know how to do it on Chrome.

[sitkack]

TIL Google is ok if you get backdoored by your boss.

[vpeters25]

The company I work for has a strict policy of no direct outbound connections from the corporate network. This is to prevent (or just make harder) for compromised machines from "phoning home".

This has the unfortunate side effect that all internet traffic must go through a proxy, they have to MiTM SSL traffic.

I just use my smartphone's data for any personal internet browsing.

[skuhn]

Well you don't have to MITM SSL in order to proxy it, it can be done in other ways. They probably choose to do so in order to see the details of the request.

[vpeters25]

Correct, the firewall intercepts all traffic looking for potential compromises and blocks it. Given all these corporations getting hacked, such measures seem necessary.

[lmm]

Conclusion does not follow from premise. Once an attacker's code is running on machines that have access to sensitive data, you've already lost - there's no way to prevent it smuggling the data out in legitimate-looking requests. The right way is to stop the bad stuff getting in in the first place.

[ent]

Not all attacks are perfect. It's true that an attacker can potentially do anything once in control of machines with sensitive data, but it doesn't mean that all hope is lost. If an intrusion detection system catches some x% of potential threats, it can easily be worth it.

[vpeters25]

The goal is to slow them down, put as many barriers as possible allowing higher chances of detecting them. Intercepting and blocking known "phone home" messages is one way to slow them down.

[vpeters25]

btw, I took a look at google's cert in my corp network and we are getting the real one from google, so my corp is not MiTM SSL traffic from some sites right now.

[Dylan16807]

I wouldn't say that's a side effect. The point of the policy is to allow the observation of website traffic to make sure it's normal.

[cesarb]

What does your company do if you have to access a TLS site which uses client certificates for authentication? AFAIK, client certificates don't work when there's a MITM on the TLS traffic, since the MITM proxy doesn't have a way to produce a client certificate that will be accepted by the server.

[cpeterso]

Are compromised machines on your corporate network a common problem? It seems like the problem is the compromised machines, not the phoning home. :)

[wongarsu]

It's called defence in depth. If you can prevent 99% of malware infections and can prevent 75% of malware from phoning home, you have a 99.75% confidence (1 in 400) of not having a data leak due to a compromised machine. That's 4 times better than only preventing infections.

[TeMPOraL]

I'm pretty sure the real reason is managers not wanting their employees to do private browsing while at work.

[enneff]

If your boss owns the tools with which you do your work, they have the right to dictate how you use them.

Use personal devices for personal computing.

[Tepix]

Not in Germany, not if there is even a minimum amount of using the computer for private purposes permitted.

[enneff]

That's interesting. So if it is forbidden to use the computer for anything personal, employers are allowed to snoop?

[NegativeK]

Perhaps a legal right.

The line between what computing should be done on what device is blurry in both directions -- it's not just "people do personal computing on corporate devices". It'd be a bit strange to hear a boss tell me to never browse Amazon or Hacker News during lunch.

[enneff]

I think it's wise to assume corporate-owned devices are just that: 0wned by corporations.

I use my work laptop all the time for a variety of things, but I do so under the assumption that the company may be snooping on me. (No idea if they are or not.)

[lione]

Exactly. It's a work machine, used for doing work. I don't do private/personal/secure things on it, as it's not my personal computer. Browsing HN or w/e isn't really a private activity, so I don't mind it being snooped.

[Dylan16807]

I wonder why people are downvoting you. It's a good point and not something everyone has explicitly considered before.

[khuey]

Common practice in some workplaces.

[danielweber]

If it's my boss's machine, yes, my boss gets to do it.

[osivertsson]

Thank for bringing this to my attention.

I guess I should look into the Chromium source to disable this MITM "feature"... I'm really too busy so if anyone else does this I'd much appreciate a patch.

[TheLoneWolfling]

Because that's not exploitable or anything.