4 ms·

Well, HTTPS could still be man-in-the-middled, right? I am not really informed, but I would not be surprised if some ISPs are even recognized as certificate aut

Well, HTTPS could still be man-in-the-middled, right? I am not really informed, but I would not be surprised if some ISPs are even recognized as certificate authorities.

jimktrains2 7y ago
MITMing TLS requires either (1) a falsely issued certificate, which would be "a big deal" when (not if) found and would lead to the issuer losing their status as accepted in browsers, or (2) the user to install a certificate generated by the person doing the MITM, this is often done in corporate environments.
- masswerk 7y ago
  Are we sure that there won't be an exception installed to this in favor of broadband providers, considering the paths already taken? Terms and conditions of this comment: This comment is provided for free to <https://news.ycombinator.com> https://news.ycombinator.com> AKA "Hacker News", including any redistribution to be considered under the clause of fair use. Any other redistribution, including injection of third party content or surrounding content, chrome, or any other HTML element(s), be it in static or generated code, is considered a violation of the terms of this contribution.
  - aaomidi 7y ago
    Your browser and OS quickly delist any certificate found to have forged a certificate for a website they don't own. They're unapologetic about it too - and don't care who they piss off.
    - masswerk 7y ago
      However, browsers have played along with US legislation previously. (E.g., when long key encryption was restricted to US versions only.) I'm not sure, if Mozilla would be playing along nowadays, but you can't be too sure, either. Moreover, you could consider certificates installed by antivirus software as some kind of prior art to this. (While considered a security risk, at least by some, they are not delisted.)
      - aaomidi 7y ago
        Antivirus ones generate the root certificate on your machine.
        masswerk 7y ago
        As may do installer software shipped by the ISP (mandatory or incentivized by cloud storage, etc.)
- awj 7y ago
  > or (2) the user to install a certificate generated by the person doing the MITM You mean like that "setup software" Comcast spent ages trying to pretend I had to install just to get things running? I ran Linux in those days, which always meant a little extra support time but I never had to install jack.
  - jimktrains2 7y ago
    That's quite possible, but many apps and browsers pin certificates and this would probably be reported quickly?
    - judge2020 7y ago
      https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#How-does-key-pinning-interact-with-local-proxies-and-filters https://chromium.googlesource.com/chromium/src/+/master/docs... > Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites.
      - jimktrains2 7y ago
        I was going off remembering this. > Late on December 24, Chrome detected and blocked an unauthorized digital certificate for the "*.google.com" domain. https://security.googleblog.com/2013/01/enhancing-digital-certificate-security.html?m=1 https://security.googleblog.com/2013/01/enhancing-digital-ce...
        LocalPCGuy 7y ago
        Pretty sure chrome has it's own code to detect Google certs and report invalid ones back to Google.

Well, HTTPS could still be man-in-the-middled, right? I am not really informed, but I would not be surprised if some ISPs are even recognized as certificate authorities.

jimktrains2 7y ago

MITMing TLS requires either (1) a falsely issued certificate, which would be "a big deal" when (not if) found and would lead to the issuer losing their status as accepted in browsers, or (2) the user to install a certificate generated by the person doing the MITM, this is often done in corporate environments.

masswerk 7y ago
Are we sure that there won't be an exception installed to this in favor of broadband providers, considering the paths already taken? Terms and conditions of this comment: This comment is provided for free to <https://news.ycombinator.com> https://news.ycombinator.com> AKA "Hacker News", including any redistribution to be considered under the clause of fair use. Any other redistribution, including injection of third party content or surrounding content, chrome, or any other HTML element(s), be it in static or generated code, is considered a violation of the terms of this contribution.
- aaomidi 7y ago
  Your browser and OS quickly delist any certificate found to have forged a certificate for a website they don't own. They're unapologetic about it too - and don't care who they piss off.
  - masswerk 7y ago
    However, browsers have played along with US legislation previously. (E.g., when long key encryption was restricted to US versions only.) I'm not sure, if Mozilla would be playing along nowadays, but you can't be too sure, either. Moreover, you could consider certificates installed by antivirus software as some kind of prior art to this. (While considered a security risk, at least by some, they are not delisted.)
    - aaomidi 7y ago
      Antivirus ones generate the root certificate on your machine.
      - masswerk 7y ago
        As may do installer software shipped by the ISP (mandatory or incentivized by cloud storage, etc.)
awj 7y ago
> or (2) the user to install a certificate generated by the person doing the MITM You mean like that "setup software" Comcast spent ages trying to pretend I had to install just to get things running? I ran Linux in those days, which always meant a little extra support time but I never had to install jack.
- jimktrains2 7y ago
  That's quite possible, but many apps and browsers pin certificates and this would probably be reported quickly?
  - judge2020 7y ago
    https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#How-does-key-pinning-interact-with-local-proxies-and-filters https://chromium.googlesource.com/chromium/src/+/master/docs... > Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites.
    - jimktrains2 7y ago
      I was going off remembering this. > Late on December 24, Chrome detected and blocked an unauthorized digital certificate for the "*.google.com" domain. https://security.googleblog.com/2013/01/enhancing-digital-certificate-security.html?m=1 https://security.googleblog.com/2013/01/enhancing-digital-ce...
      - LocalPCGuy 7y ago
        Pretty sure chrome has it's own code to detect Google certs and report invalid ones back to Google.