Comment on North Korean infiltrator caught working in Amazon IT department thanks to lag — 110ms keystroke input raises red flags over true location

• Brkdncr@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  You’re sure they aren’t decrypting your traffic? Check the root cert of any site and see if it’s their own root.

  source

  • dan@upvote.au ⁨3⁩ ⁨weeks⁩ ago

    Larger companies that monitor for corporate passwords being entered on third-party sites usually use a browser extension that’s force-installed using Chrome Enterprise.

    source

    • Brkdncr@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      Why do you say usually? It’s not what I do. I MitM every machine.

      source

      • dan@upvote.au ⁨2⁩ ⁨weeks⁩ ago

        It’s what I’ve experienced at FAANG companies. MitM isn’t used and would break certificate pinning on sites (including internal tools) that use both certificate pinning and HSTS.

        source

        • -> View More Comments
  • BrianTheeBiscuiteer@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    This is definitely a thing.

    source

    • EncryptKeeper@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      Only if the site they’re visiting isn’t using HSTS, but it’s possible

      source

      • foobaz@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

        I don’t think this is correct. HSTS only prevents downgrading.

        source

        • -> View More Comments
  • fonix232@fedia.io ⁨2⁩ ⁨weeks⁩ ago

    Yep, they're not decrypting HTTPS, I've triple checked. But we do have an MDM forced proxy service that does check any non-encrypted traffic...

    source
• Ghoelian@piefed.social ⁨3⁩ ⁨weeks⁩ ago

  set all my APs and router and switches and other network nodes to HTTPS

  What does that mean? HTTPS is a client-server thing, your APS and switches don’t really have anything to do with that.

  source

  • fonix232@fedia.io ⁨2⁩ ⁨weeks⁩ ago

    Web control panel. All my network runs OpenWrt and I prefer to manage it from the web UI instead of terminal tinkering.

    source

    • Ghoelian@piefed.social ⁨2⁩ ⁨weeks⁩ ago

      Ahh that makes sense. I thought you were claiming you somehow got all your traffic over HTTPS with some AP settings.

      source
  • Darkassassin07@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago

    Setting their management interfaces to be accessed via https because the VPN blocks (after snooping on) http only access would be my guess

    source
• porcoesphino@mander.xyz ⁨3⁩ ⁨weeks⁩ ago

  Annoying, but ideally it would have been the initial configuration

  source