On Tuesday, December 12, 2017 04:13:48 PM Yuri wrote: > On 12/12/17 11:56, Eugene Grosbein wrote: > > https://wiki.squid-cache.org/Features/SslPeekAndSplice > > > > You either ignore MITM and proceed with connection anyway or have no > > connectivity via this channel at all. > When the user sees that SSL/TLS is stripped, this isn't a vulnerability > of the protocol. User can make a choice to use such connection anyway. > There are command line options like this for some commands, and the > choice in the browser. > > Compare this with https using compromised by government CA, when the > user doesn't have any way of knowing about MITM. So https+private CA > stands secure.
I think you're missing the point. It is a sad reality that SSL/TLS corporate (and ISP) MITM exists and is enforced on a larger scale than we'd like. But it is there, and when mandated/enforced you have to go through the MITM appliance, or not connect at all. Private CA's generally break those appliances - an unfortunate FreeBSD user in this situation is cut off. How is this better? -- Peter Wemm - [email protected]; [email protected]; [email protected]; KI6FJV UTF-8: for when a ' or ... just won\342\200\231t do\342\200\246
signature.asc
Description: This is a digitally signed message part.
