<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">26.03.2018 05:23, Amos Jeffries пишет:<br>
</div>
<blockquote type="cite"
cite="mid:88b9fe1e-0340-d99a-ac2b-b2938c793944@treenet.co.nz">
<pre wrap="">On 26/03/18 12:07, Yuri wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
26.03.2018 05:05, Amos Jeffries пишет:
</pre>
<blockquote type="cite">
<pre wrap="">On 26/03/18 11:05, Yuri wrote:
</pre>
<blockquote type="cite">
<pre wrap="">And yes, HTTPS is insecure by design and all our actions does not it
less insecure :-D
</pre>
</blockquote>
<pre wrap="">We are not talking about HTTPS. Only about TLS. Because the TLS decrypt
is what is "failing" at the time any of these details we are discussing
are relevant.
The "page" mentioned is HTML created by the _client_ as its way to show
the user things. Still no HTTP(S) involvement. Squid has zero
involvement with that so cannot make it do anything active (like install
CA certs).
</pre>
</blockquote>
<pre wrap="">Exactly. Users do. And we're almost have all required tools to implement
user'driven helper ;)
</pre>
</blockquote>
<pre wrap="">
Yet again you are circled back to involving the user. Remember the
original point was trying to do things *without any user* knowing or
being involved.</pre>
</blockquote>
I could not make such a stupid idea. It does not work out that way.
The user is always asked whether trust the installing CA
certificate.<br>
<br>
The only way known for me to make this silently - using AD group
policy.<br>
<br>
AFAIK, we're discussing usual way with catch error and redirect to
page. No more. Captive Portal, Splash, ACL etc.<br>
<br>
<blockquote type="cite"
cite="mid:88b9fe1e-0340-d99a-ac2b-b2938c793944@treenet.co.nz">
<pre wrap="">
This is what I mean by "TLS used properly" - proper is when it always
circles back to user deciding who they trust. No matter how indirectly,
the user installs a (root) CA causing trust or allowed someone else to
do so.</pre>
</blockquote>
Generally speaking, yes. <br>
<br>
I just mean, that in some other protocols you have no any
possibility to make MiTM by any way, whenever installing something
or not. This prevents any improper or malicious use of protocol. <br>
<br>
TLS<b> have</b> this possibility. SSH is <b>not</b>. You can't MiTM
or compromise SSH by installing any key/certs to client. Correct?
This is by design?<br>
<br>
<blockquote type="cite"
cite="mid:88b9fe1e-0340-d99a-ac2b-b2938c793944@treenet.co.nz">
<pre wrap="">
Amos
_______________________________________________
squid-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a>
<a class="moz-txt-link-freetext" href="http://lists.squid-cache.org/listinfo/squid-users">http://lists.squid-cache.org/listinfo/squid-users</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
"C++ seems like a language suitable for firing other people's legs."
*****************************
* C++20 : Bug to the future *
*****************************</pre>
</body>
</html>