Hacker News new | ask | show | jobs
by josephkern 4071 days ago
They can't buy and configure an HTTPS proxy? Those things do exist after all.
1 comments

HTTPS proxies work less well today than they did even five years ago. Certificate pinning and other security improvements have broken a lot of things (by design).

So the question is: What is more important, allowing HTTPS proxies, or stopping governments with a CA from MitM-ing traffic (e.g. Iran, China, etc).

A nice compromise might be to inform users that they're being MitM-ed by an installed CA, but only once and subtly so.

Which browsers enforce pinning when faced with a CA proxy? Chrome explicitly overrides pinning in this case, so they don't break half of all corporate usage.