4 ms·
>I also don't know how an ISP would get your actual internet history if the website uses HTTPS. Charge users extra fees for "premium service" unless they agree
by curt15 9y ago
>I also don't know how an ISP would get your actual internet history if the website uses HTTPS.
Charge users extra fees for "premium service" unless they agree to let the ISP their traffic.
- manigandham 9y agoHow does that change how HTTPS works?
- sqeaky 9y agoIt doesn't, but the ISP still know what pages you went to. If they want to determine your political leanings your browsing history is enough.
- manigandham 9y agoHow would the ISP know what pages you went to over HTTPS? Only the domain name would be available, through SNI/DNS.
- rocqua 9y agoThey could just MITM all connections and say 'for compatibility reasons, please install this root certificate'. With a fee, this requirement could then be waived. Dystopian but technically possible.
- narrowrail 9y agoThis type of hypothetical drives me batty, and I was tempted to be snarky. I'm not sure how to respond to the idea that there will ever be a time your ISP requires root cert installation for service, but I will be finding a way to launch a WISP of my own at that point.
- rocqua 9y agoMy original was already snark. Though I don't think its impossible that a small amount of non-technical people might actually be convinced to do this.
- pdkl95 9y agoIt's only slightly hypothetical. http://www.csoonline.com/article/2865806/cloud-security/gogo-inflight-internet-serves-up-man-in-the-middle-with-fake-ssl.html http://www.csoonline.com/article/2865806/cloud-security/gogo... Gogo didn't require installing a root cert, but they DID issue forged certificates to MitM connections to *.google.com (and others). Also, remember "Superfish"? Their root cert was pre-installed by Lenovo.
- ufo 9y agoJust the domain names is already a lot of information...