up vote 0 down vote favorite
share [g+] share [fb]

I have recently been reading up on the capabilities of TMG HTTPS inspection

http://technet.microsoft.com/en-us/library/ee658156.aspx

The theory behind the use cases sounds fine (you want to stop mal-ware from being downloaded from HTTPS sites)

But basically TMG is acting as a "Man in the Middle" attack.

Depending on how your work domain is setup, this can all happen without the user even being told that their HTTPS traffic is being inspected. So much for privacy.

All the work domain needs to do is enforce a group policy with a trusted root certficates for the self signed TMG certs.

Does the browser report that the HTTPS is not valid?

link|improve this question
1  
"So much for privacy." There should be no expectation of privacy when you're on someone else's network. – MDMarra Apr 12 '11 at 2:09
@MarkM: No, merely being on someone else's network is a case when SSL should protect you. It's having your machine controlled by someone else (in this case, GPOs on an AD domain) when all privacy is lost. – grawity Apr 12 '11 at 12:13
@grawity, unfortunately, that's not how the world operates. – MDMarra Apr 12 '11 at 12:59
@MarkM: unfortunately, I don't have much knowledge about how the world operates, so would you please elaborate? – grawity Apr 12 '11 at 13:47
@grawity, There are a million and one ways in which an employer can (and will) monitor computers on their network. If you don't own the computer, and you don't operate the network, then it's pretty common practice for usage to be monitored. – MDMarra Apr 12 '11 at 17:35
feedback

1 Answer

up vote 3 down vote accepted

Technically no, the certs will be trusted and you will be none the wiser. Note that TMG is, while illustrative, a red herring here; domain machines can have domain certs installed for other reasons.

You have to trust any installed certificate provider to only issue valid certificates for a domain name; your IT department could theoretically intercept any HTTPS traffic and generate a certificate for it and MITM you, and you would trust the certificate because your internal name is a trusted provider.

That said, you'd have to have a hell of an IT department to pull it off. Given how many IT departments can barely manage the banal, I wouldn't worry too much about it. You could discover such subterfuge by checking the certificate info in the usual way from the address bar; the certificate issuer will be your internal domain.

link|improve this answer
yeah thats what i thought, will the "Identitifed by ..." feature of the browser pick up the difference? – djeeg Apr 12 '11 at 3:05
Yeah, that's what I was alluding to at the end: you'd see it verified not by e.g. Verisign but by your internal domain. I'm not sure if that could be made to be misleading too though. – Mark Sowul Apr 12 '11 at 10:49
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.