4 ms·
"Each time you use a credit card, each time you read your bank statement, all of your IP information and your search history will be required by your ISP to be
by biafra 15y ago
"Each time you use a credit card, each time you read your bank statement, all of your IP information and your search history will be required by your ISP to be stored for 18 months at all times."
How can my ISP store my search history? DuckDuckGo and Google offer https to do the searching.
How can my ISP know where I use my credit card? Whenever I pay by credit card I use https.
- scotth 15y agoUgh...yeah. Just another case of technology confusion. The bill's bad nonetheless, but one thing's for sure: the ISPs won't be spying on your searches or your banking.
- esteth 15y agoI might be revealing my stupidity here, but surely your ISP can MITM the HTTPS handshake and decrypt all of your traffic? Unless you have a pre-arranged key that hasn't travelled through their network.
- ahelwer 15y agoThis is the purpose of certificates.
- HoLyVieR 15y agoThe thing with certificate is that you have to trust that the certificate authorities won't sell (or give) fake certificate to ISP or government. If they do so, the ISP can MITM you.
- vidarh 15y agoSSL is designed so that only the server with the private key for a specific certificate can complete the handshake correctly for that certificate, and the certificate is tied to the domain name. The ISP can MITM the handshake and return a different certificate, but unless a certificate authority supported by your browser is complicit, they can't get that certificate signed for the domain you're trying to visit, and the browser will complain.
- ori_b 15y agoI would expect that if the US government is requiring this, they'd also be able to get at least a few US based certificate authorities to play along.
- vidarh 15y agoIf they did, we'd get versions of Firefox and Chromium at least with the US certificate authorities root certs yanked out within a day, and companies scrambling to replace their SSL certs with certs that'd still be trusted by users. Unless they made it illegal to, I'm sure we'd see all the major browsers work to deprecate those certificate authorities pretty quickly - not doing so would make SSL useless.
- keen 15y agoI'm sure we'd see all the major browsers work to deprecate those certificate authorities pretty quickly What about the recent Comodo breaches? Their certs are still trusted by all major browsers (as far as I'm aware). I realise they weren't complicit in issuing the fraudulent certs, but the effect is the same.
- ori_b 15y agoAssuming that they bothered mentioning it.
- gergles 15y agoYour ISP won't be able to get a trusted certificate authority to issue them a cert for "*", which is what they would need to do in order to transparently MITM SSL. They could generate that cert on their own, and maybe install it into the Windows cert store with the "installation CD", but they couldn't intercept your traffic on an unadulterated system.