3 ms·

It really shouldn't be and (AFAIK) isn't trivial for people to get root certs any more unless they can get end-users to install them on their systems. It used

It really shouldn't be and (AFAIK) isn't trivial for people to get root certs any more unless they can get end-users to install them on their systems. It used to be relatively straightforward (you could buy security appliances that had them) but that was quite a long time ago, things have tightened up considerably since then. So if an ISP wants to do this, the only other option is a mandatory proxy.

bradknowles 3y ago
How many root certificate authorities are there in the world that are trusted by default by most browsers, or have their authority cross signed by one of the trusted root certificate authorities. At last count, the number I heard of was north of 300. All it takes is one of them being semi shady and being willing to sell or cross sign root certs for someone else, like an ISP. And surprising number of those 300+ are pretty shady. This is one of the methods used in the Great Firewall of China. Or Russia. Or a number of other countries. And most of those countries have smaller annual budgets than AT&T. Of course, that's also why a lot of people in China use VPNs. Just like any sufficiently well funded company or country can go to certain businesses in Israel and get professional zero day/no touch malware that they can drop on any unsuspecting target. And Israel is not the only country selling that kind of technology.