Unfortunately, Chrome's current policy is to disable certificate transparency and HPKP when a certificate appears to have been manually installed, to support MITM proxies [1].
Needless to say, this makes HPKP and certificate transparency worthless when the client has been compromised by adware or viruses.
Why don't they change the green lock icon to a blue icon indicating a pair of eyes, that when clicked on explains that the connection is not secure because your IT department is monitoring the connection?
> Chrome's current policy is to disable certificate transparency and HPKP when a certificate appears to have been manually installed, to support MITM proxies
Sidenote: Is there a way to disable these on iOS to inspect SSL traffic through a MITM proxy?
Firefox accepts local certs over pinned ones by default as well (superfish affected it too).
I believe there is an about:config setting that can be changed to have it reject local certificates in the face of a pinned site, but if malware is putting certificates in Firefox's cert store, they can just as easily flip that setting as well.
Needless to say, this makes HPKP and certificate transparency worthless when the client has been compromised by adware or viruses.
[1] https://www.chromium.org/Home/chromium-security/security-faq...