AnyProxy

Get Pro
Glossary · Web tech

MITM (Man-in-the-Middle)

Also calledman in the middle attacktls interception
Definition

A man-in-the-middle (MITM) is anything that sits between you and a website and can read or change the traffic, whether as an attack, as company policy or as a service you chose.

Explanation

In depth

HTTPS is designed to stop interception. The site proves its identity with a certificate from a public authority your device already trusts, and the browser warns you if anything else answers. A man-in-the-middle gets around that in one of three ways. An attacker can trick you into ignoring the certificate warning. An organisation can install its own root certificate on managed laptops so its firewall can decrypt and re-encrypt traffic; that is normal in companies and schools. Or a government can ask everyone to install one. Kazakhstan did that in July 2019, and in August 2019 Mozilla and Google blocked that certificate in their browsers. A web proxy is a man-in-the-middle you chose, and it does not need a fake certificate. Your browser connects to the proxy's own domain, and the proxy opens a second, separate HTTPS connection to the site. AnyProxy's privacy policy says this plainly: the operator handles the decrypted content between those two connections. So the proxy can technically see what you read and type. That is why you should not log in to sensitive accounts through any web proxy you do not trust.

In practice

MITM (Man-in-the-Middle) in the real world

The two-connection design is visible in a trace. Opened through AnyProxy Frankfurt on 15 Oct 2026, Cloudflare's trace page saw a TLS 1.3 connection from the proxy server, located in DE, not from the visitor. Your browser's connection ends at fr.anyproxy.site, which holds its own Let's Encrypt certificate, so no warning appears and no fake certificate is involved. That is honest, but it also means the proxy is a point where pages exist unencrypted.

Sources: Mozilla Security Blog — Protecting our users in Kazakhstan (21 Aug 2019) · AnyProxy privacy and data handling · Cloudflare trace page used in the tests

We checked

The second, separate connection a web proxy makes (15 Oct 2026)

Cloudflare trace page opened through AnyProxy Frankfurt, listing colo=FRA, loc=DE, http=http/2, tls=TLSv1.3 and sni=plaintext, with the IP line hidden

Open Cloudflare's diagnostic page one.one.one.one/cdn-cgi/trace through the Frankfurt region

Worked · FR exit · 2026-10-15

Page loaded as plain text: colo=FRA, loc=DE, tls=TLSv1.3, http=http/2, sni=plaintext, kex=X25519MLKEM768. The ip= line (the proxy's exit address) was hidden before the screenshot.

Questions about MITM (Man-in-the-Middle)

How do I know if my HTTPS traffic is being intercepted?
Open the certificate details for a site. If the issuer is your employer, school, antivirus or an unknown authority instead of a public CA, something is decrypting your traffic.
Is a web proxy a man-in-the-middle?
Yes, by design. It decrypts pages so it can fetch and rewrite them for you. Choose one whose operator and policies you trust, and avoid sensitive logins.
Why did browsers block Kazakhstan's certificate?
It existed to let ISPs decrypt citizens' HTTPS traffic. In August 2019 Mozilla and Google made their browsers distrust it even when users had installed it.

Related terms

TLS handshakeThe TLS handshake is the opening exchange of every HTTPS connection, in which browser and server agree on encryption keys and the server proves which site it is.HTTPS proxyAn HTTPS proxy is a proxy you connect to over an encrypted (TLS) link, so even the name of the site you ask it for is hidden from your local network.Transparent proxyA transparent proxy is one the network puts in your path without you setting it up; on proxy lists the same word means a proxy that passes your real IP along.

Put the concept to work

Try AnyProxy free — no install, no signup, six regions.

Open a blocked page