Forgot your password?
typodupeerror
Security

Ask Slashdot: Does Your Employer Perform HTTPS MITM Attacks On Employees? 572

Posted by Unknown Lamer
from the padlock-icon-says-I'm-good-right dept.
New submitter Matt.Battey writes "I was recently on-site with a client and in the execution of my duties there, I needed to access web sites like Google Maps and my company's VPN. The VPN connection was rejected (which tends to be common, even though it's an HTTPS based VPN service). However, when I went to Google Maps I received a certificate error. It turns out that the client is intercepting all HTTPS traffic on the way out the door and re-issuing an internally generated certificate for the site. My client's employees don't notice because their computers all have the internal CA pushed out via Windows Group Policy & log-on scripts.

In essence, my client performs a Man-In-The-Middle attack on all of their employees, interrupting HTTPS communications via a network coordinated reverse-proxy with false certificate generation. My assumption is that the client logs all HTTPS traffic this way, capturing banking records, passwords, and similar data on their employees.

My question: How common is it for employers to perform MITM attacks on their own employees?"
This discussion has been archived. No new comments can be posted.

Ask Slashdot: Does Your Employer Perform HTTPS MITM Attacks On Employees?

Comments Filter:

"A mind is a terrible thing to have leaking out your ears." -- The League of Sadistic Telepaths

Working...