Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> or (2) the user to install a certificate generated by the person doing the MITM

You mean like that "setup software" Comcast spent ages trying to pretend I had to install just to get things running?

I ran Linux in those days, which always meant a little extra support time but I never had to install jack.



That's quite possible, but many apps and browsers pin certificates and this would probably be reported quickly?


https://chromium.googlesource.com/chromium/src/+/master/docs...

> Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites.


I was going off remembering this.

> Late on December 24, Chrome detected and blocked an unauthorized digital certificate for the "*.google.com" domain.

https://security.googleblog.com/2013/01/enhancing-digital-ce...


Pretty sure chrome has it's own code to detect Google certs and report invalid ones back to Google.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: