3 ms·
I thought DPI was for analyzing and blocking traffic. How are they able to decrypt, modify and re-encrypt the payload? Unless they are MITM and have access to a
by ficklepickle 6y ago
I thought DPI was for analyzing and blocking traffic. How are they able to decrypt, modify and re-encrypt the payload? Unless they are MITM and have access to a root signing cert and are creating valid false certificates in real-time. Or they get the end user to add a malicious root cert to their store.
Ads can be changed with plain HTTP requests, or DPI can be used to gain info about the HTTPS request and possibly block subsequent requests. The I in DPI is for inspection, AFAIK modification would be very difficult.
- joveian 6y agoMany companies seem to be determined to defeat encryption via the public use of vanity domains that redirect without supporting TLS on the published domain name. Usually this is for particular marketing campaigns and not the main site, however as long as browers support HTTP only redirects it is a poential risk for many sites (depending on the browser and any other measures they take to avoid such things). US banks have also been training customers to accept redirects to various shady sounding domains as a normal thing so there is a huge variety of domains that could be used to MITM with full TLS and without seeming unusual. Still not trivial to do the MITM and avoid detection. So hopefully that raises the cost to the point that Centurylink and Comcast won't actually do it but they obviously would not have any ethical reservations about doing something like that if it made them more money.