Why don't browsers warn users when they try to access https websites through proxy? [closed]

Question

Browsers show you an ugly red screen if you try to access a https website whose certificate is fake.

But why don't thes warn when you try to access a https site, like GMail, through the corporation's proxy?

If I understand proxies well, the computer asks them to load secure websites and tell the results, so the proxy will generate the https requests. Althrough the request between the proxy and web is secure, the sysadmin can still intercept your passwords and the content you viewing, isn't he?

Isn't this a security corcern?

(On many forums I saw many people think proxy = NAT, so I was unable to get my answer. :( )

Answer 1

Normal HTTPS proxies don't have access to the cryptographic keys or plaintext and so there is no security implication for the end user to be warned of.

In order to support HTTPS, proxies implement a special HTTP method: CONNECT, documented in RFC 2817. On receipt of a CONNECT request, the proxy opens a TCP connection to a specified remote server and then simply passes data between the client browser and the remote server without modifying it. The client browser simply transmits its TLS data to the proxy for onward transmission to the remote server. While the proxy has access to all the data, it only sees the encrypted data stream and can do nothing with it. While this is a good thing from a security point of view it also means that none of the data can be cached.

From Cambridge

A dozen years ago, I used to administer a HTTP/HTTPS proxy for a very large multinational corporation. The above was certainly true then.

Answer 2

When you connect to a encrypted website your browser initiates a secure conection using the certificate of the website, and double checks if the certificate offered by the website matches the url of the website.

So for a proxy in between to be able to intercept/read what you are doing on a encrypted website it has to offer another certificate (which matches the domain of the original website) and make your browser believe everything is all right. This actually happened recently.

tl;dr A proxy will only see that you are using a encrypted website not the http requests passwords specific urls you are using.

Answer 3

It's relatively normal (in recent times) for corporate proxies to also intercept https trafic.

The reason the browser doesn't complain is because you are using the company PC, which will have installed an extra CA.

This extra CA will sign the https certificates the proxy returns, so your browser doesn't complain (they are valid certificates, as far as he knows).

If you check the certificate, you will probably see that any site you access via https is signed by the same CA.

And yes, everything you do with this type of proxies will be visible to the system admins (including passwords, etc), if they actually care.

Depending on the permissions you have on the machine, you could remove this company CA from the list of accepted CAs in the browser. Or use a live CD.