← Back to context Comment by sandos 11 hours ago Even with corporate MITM setups? I somehow doubt it.. 5 comments sandos Reply megous 9 hours ago MITM only works if you allow trust in corporate CA on the outbound HTTPS connections. And why would you? jon-wood 7 hours ago Its not always the case but many of MITM-ing corporate firewalls are going to immediately drop any TLS connection they can't decrypt on the basis they're coming from an unauthorised device. LeBit 9 hours ago No need for MITM.DPI immediately can tell it is ssh. megous 9 hours ago Yeah, sure. By magic I guess. :) p_l 7 hours ago No, by DPI. SSH has recognizable signature as does web sockets etc.Takes flipping one switch for 443 to be made HTTPS + HTTP2 + websocket only by egress firewall if you paid for one with DPI
megous 9 hours ago MITM only works if you allow trust in corporate CA on the outbound HTTPS connections. And why would you? jon-wood 7 hours ago Its not always the case but many of MITM-ing corporate firewalls are going to immediately drop any TLS connection they can't decrypt on the basis they're coming from an unauthorised device.
jon-wood 7 hours ago Its not always the case but many of MITM-ing corporate firewalls are going to immediately drop any TLS connection they can't decrypt on the basis they're coming from an unauthorised device.
LeBit 9 hours ago No need for MITM.DPI immediately can tell it is ssh. megous 9 hours ago Yeah, sure. By magic I guess. :) p_l 7 hours ago No, by DPI. SSH has recognizable signature as does web sockets etc.Takes flipping one switch for 443 to be made HTTPS + HTTP2 + websocket only by egress firewall if you paid for one with DPI
megous 9 hours ago Yeah, sure. By magic I guess. :) p_l 7 hours ago No, by DPI. SSH has recognizable signature as does web sockets etc.Takes flipping one switch for 443 to be made HTTPS + HTTP2 + websocket only by egress firewall if you paid for one with DPI
p_l 7 hours ago No, by DPI. SSH has recognizable signature as does web sockets etc.Takes flipping one switch for 443 to be made HTTPS + HTTP2 + websocket only by egress firewall if you paid for one with DPI
MITM only works if you allow trust in corporate CA on the outbound HTTPS connections. And why would you?
Its not always the case but many of MITM-ing corporate firewalls are going to immediately drop any TLS connection they can't decrypt on the basis they're coming from an unauthorised device.
No need for MITM.
DPI immediately can tell it is ssh.
Yeah, sure. By magic I guess. :)
No, by DPI. SSH has recognizable signature as does web sockets etc.
Takes flipping one switch for 443 to be made HTTPS + HTTP2 + websocket only by egress firewall if you paid for one with DPI