Excellent paper from MSFT Research on inline proxies vs. SSL

This short write-up reviews the Microsoft Research paper 'Pretty-Bad-Proxy', which demonstrates techniques for malicious inline proxies to inject a 502 response that causes browsers to execute attacker-controlled JavaScript in the security context of an HTTPS site (enabling credential/session theft). The authors disclosed the issue to vendors and it was subsequently remediated.