No, Fiddler is an active ManInTheMiddle attack.
No, Fiddler is an active ManInTheMiddle attack. With HTTPS interception it always substitutes the certificate (which is the public key). The substituted public key allows the proxy to negotiate a TLS session between the browser and the proxy, impersonating the real server. You avoid a certificate error if you install the signing CA certificate in the browser; but you still tamper with the traffic. There are scenarios where mitm doesn't work; for example Client Authenticated TLS. Things like certificate pinning, where the browser expects a specific public key, also break intetception.
Posted by throwaway8384 on Feb 12, 2015, 10:25 PM
Tags
Related issues
- CC v2.1.100+ inflates cache_creation by ~20K tokens vs v2.1.98 — same payload, server-side
- Max Plan: Token usage increased ~3-5x without any configuration change (since ~March 28-29)
- I use 43" Dell Ultrasharp, it comes with built-in kvm for switching between signal sources so I can connect both my macbook and linux lap...
- Feature Request: Official Headless Mode & Enhanced CLI for Steam Client
- Linux workspace rendering issues
- Git - create git graph visualization
Raise real-world problems, find people facing the same issue, and discuss solutions.8,000 issues0 comments
onboarding (Sysadmin)
CC v2.1.100+ inflates cache_creation by ~20K tokens vs v2.1.98 — same payload, server-side
Max Plan: Token usage increased ~3-5x without any configuration change (since ~March 28-29)
I use 43" Dell Ultrasharp, it comes with built-in kvm for switching between signal sources so I can connect both my macbook and linux lap...
Feature Request: Official Headless Mode & Enhanced CLI for Steam Client
Linux workspace rendering issues
Git - create git graph visualization
High memory usage from VMMEM with docker desktop windows x64 V4.12.0
Cannot apply CRD and a CR using it in the same plan/apply due to SSA
No, Fiddler is an active ManInTheMiddle attack.
No, Fiddler is an active ManInTheMiddle attack. With HTTPS interception it always substitutes the certificate (which is the public key). The substituted public key allows the proxy to negotiate a TLS session between the browser and the proxy, impersonating the real server. You avoid a certificate error if you install the signing CA certificate in the browser; but you still tamper with the traffic. There are scenarios where mitm doesn't work; for example Client Authenticated TLS. Things like certificate pinning, where the browser expects a specific public key, also break intetception.
Comments (0)
No comments yet. Start the discussion.