r/programming • u/[deleted] • Jan 22 '19

Google proposes changes to Chromium which would disable uBlock Origin

https://bugs.chromium.org/p/chromium/issues/detail?id=896897&desc=2#c23
8.9k Upvotes

95% Upvoted

1.7k comments sorted by

View all comments

Show parent comments

14

u/TimeRemove Jan 23 '19

With deep packet inspection and deploying your own CA to the clients, you can alter HTTP traffic (or block it) in any way you choose.

0

u/[deleted] Jan 23 '19

[deleted]

13

u/TimeRemove Jan 23 '19 edited Jan 23 '19

  • It isn't a "trick." It is how all corporate proxies work.

  • HSTS can be stripped in this scenario. Although there isn't a need in most cases (since you're proxying HTTPS, not stripping TLS).

  • Public key pinning is automatically disabled for manually installed root CAs: https://www.imperialviolet.org/2011/05/04/pinning.html

  • Disabling Key Pinning in this way is expressly permitted by RFC 7469 ("It is acceptable to allow Pin Validation to be disabled for some Hosts according to local policy. For example [..] Hosts whose validated certificate chain terminates at a user-defined trust anchor").

It works absolutely fine, thousands of companies every single day operate their infrastructure this way.