Hacker News

points by sandos 1 day ago | 0 comments

Even with corporate MITM setups? I somehow doubt it..

MITM only works if you allow trust in corporate CA on the outbound HTTPS connections. And why would you?

Its not always the case but many of MITM-ing corporate firewalls are going to immediately drop any TLS connection they can't decrypt on the basis they're coming from an unauthorised device.

[–] LeBit 1 day ago

No need for MITM.

DPI immediately can tell it is ssh.

[–] megous 1 day ago

Yeah, sure. By magic I guess. :)

[–] p_l 1 day ago

No, by DPI. SSH has recognizable signature as does web sockets etc.

Takes flipping one switch for 443 to be made HTTPS + HTTP2 + websocket only by egress firewall if you paid for one with DPI