[GTALUG] Decrypting and Re-encrypting Network Traffic

[William Park]

My company is doing this "man in the middle" thing.  As long as they don't encrypt my paycheck, I'm fine with it.  Just don't do personal banking at work.  They'll know all your passwords.

Sent from Yahoo Mail on Android 
 
  On Tue, Sep 10, 2019 at 5:09 PM, Giles Orr via talk<talk at gtalug.org> wrote:   Decrypting and re-encrypting network traffic is becoming more and more popular.  I think it's an appalling violation of both trust and privacy, but corporations seem to feel justified to "protect their network" (it's not necessary to explain the logic to me, I get it ... I'm just more about individual rights).  Or maybe they're just doing it to mine your data, depending on the context.
There seem to be two circumstances (this is just about web traffic):- a private computer on a shared network, ex. you take your personal computer to a coffeeshop- a company computer on a company network, ex. you sit down at your work computer
I think I understand the latter: with a company computer on a company network, all that's necessary is to push a trusted certificate and all future communications will be done with that newly trusted cert and, well, you're hosed.  Everything you send is examined and re-encrypted with the receiving site's certificate at the company firewall.  Can this be detected?  Can this be prevented?
It seems that some shared networks (ie. the coffeeshop in the above examples) manage to do this to people: is this only possible if they convince you to install something, and presumably that install package includes a certificate?  Or is there another way?

-- 
Giles
https://www.gilesorr.com/
gilesorr at gmail.com---
Post to this mailing list talk at gtalug.org
Unsubscribe from this mailing list https://gtalug.org/mailman/listinfo/talk
  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://gtalug.org/pipermail/talk/attachments/20190911/d5dcbfea/attachment-0001.html>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: Untitled
URL: <http://gtalug.org/pipermail/talk/attachments/20190911/d5dcbfea/attachment-0001.ksh>