5

I'm relatively tech-savvy, but I'm no security expert. To my understanding, an invalid SSL certificate is only a problem if you're going to provide some sort of potentially exploitable information to a website and you are not sure that the website you're at is truly owned by the organization you believe it to be.

I ask because my workplace uses content filtering that makes every SSL cert invalid. The browser sees the website as originating from the content filtering server on the network rather than the actual server the website is being served from. I'm tempted to simply turn off certificate checking altogether in my browser (Firefox) because it's not doing anything for me other than creating hassle, but I wanted to check to see if there's some facet of the issue I might be missing? I'm smart enough to ensure that the website I'm visiting is the website I think I'm visiting without the confirmation of the cert, so based on my understanding, I shouldn't have any problems.

Improve this question
2
  • 5
    Even if the site you're visiting is the site you think you're visiting, I think that (but am not 100% sure) filtering could open you to man in the middle attacks by your employer.
    – AndrejaKo
    May 25, 2011 at 18:12
  • @AndrejaKo - I suggest expanding upon your comment a bit, and posting it as an answer. It's a very good point.
    – Iszi
    May 25, 2011 at 18:26

2 Answers 2

Reset to default
2

Basically with that kind of proxy, your employer can see even banking information and such via SSL because they have an unencrypted copy via the proxy. Your computer is requesting a webpage from the proxy server, and then your employer's proxy server is requesting the pages from the destination on your behalf, and the proxy software gets an unencrypted copy because it is in the middle. So the proxy can see the contents of every web page you see. The only way SSL is secure is when your PC and the destination PC talk directly via SSL.

Your browser is correctly warning you that your information is not secure. I think that the connection between the three points is still using encryption, so the whole world can't see it - just your employer.

One note to remember, even with SSL turned on properly, your employer can still see the URLs (in the browser address bar) that you go to. Most search engines like google place a lot of information in the URL (words you searched for, etc).

Improve this answer
1
  • In addition to that, since you can't see the real ssl cert, that proxy server will not let you know if the website you visit is the real thing. Somebody malicious or even your employer could create a fake version of some important website and you won't know you got duped. For example your payroll website or your company partner's sites. They can create a fake but realistic looking login page and fish out your passwords. Yes, everything you do on company's computer is their property, but this (stupid/incompetent) IT policy actually puts the company in danger.
    – Mxx
    Sep 29, 2012 at 4:15
1

The main problem, IMHO, is that your browser (or your client's browser) is always complaining about invalid certificates. If it happens once in a while, you go and check whether is an error or not. If it happens every time you stop checking. I mean, your information could be safe from sniffing because you're encrypting the communication channel, but you may be talking with a rogue server, and that could be easily exploited.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .