Re: HTTPS redirects to HTTP for monitoring

[Tim Franklin <tim () pelican org>]

> By the way, I hope that all of the people who have been ranting about
> this have read this note.  The only way this filtering works is if the
> client computers have a special CA cert installed into their browsers.
> That means it's a private organizational network that manages all its
> client computers, or it's a service where the users specifically do
> something on their own computers to enable it.

In the first instance, I'd still very much *want* the organisation to tell the users that the internal IT people are 
breaking their SSL, so please not to have any expectation that security is doing what you think it is.  While it's not 
an organisation I'd particularly enjoy working for, at least I then know not to do online banking in my lunch break, or 
similar.  Pushing out internal MITM CAs silently *is* still evil, in my view, although sadly closer to what I'd 
*expect* to happen.

Regards,
Tim.