10 ms·

My ISP (Mediacom) appears to have a deal with certain websites to display service messages. The only two I've encountered it on is Amazon and Facebook but they

My ISP (Mediacom) appears to have a deal with certain websites to display service messages. The only two I've encountered it on is Amazon and Facebook but they are somehow able to insert a maintenance banner at the top of those two when downtime is anticipated or if I am near the end of my bandwidth quota. Haven't gotten any ads this way but they have the technology.

Philip-J-Fry 1y ago
Pretty sure this is done on your router. They terminate TLS on your router, inject their malware and then re-encrypt.
- notpushkin 1y ago
  > and then re-encrypt How?
  - tialaramex 1y ago
    One thing you can arrange is "Oh, you need to trust our Router's security thing" and so you're adding a new private root CA trust, then they "just" issue CA certs which they've arranged for you to trust. This is commonly how corporate and institutional systems are set up, it's a terrible idea but it's very common. One thing that helps drive it away at work is that we're a University, and essentially all the world's universities have a common authenticated WiFi (because students and perhaps more importantly, academics, just travel from one to another and expect stuff to work, if you got a degree in the last 20 or so years you likely used this, eduroam) but obviously they don't trust each other on this stuff so their sites all use the Web PKI, the same public trust as everybody else, internal stuff might not, but the moment you're asking some History professor to manually install a certificate you might as well assign them a dedicated IT person, so, everything facing ordinary users has public certs from, of course, Let's Encrypt. Edited to name eduroam specifically.
    - notpushkin 1y ago
      > This is commonly how corporate and institutional systems are set up, it's a terrible idea but it's very common. Tbh makes it kinda sense for those systems, when used only with internal tools and on company devices... but yeah I’d just (of course) Let’s Encrypt if I was setting it up for a client.
    - BrandoElFollito 1y ago
      Wrong information removed - you were right, I was wrong. I apologize.
      - kalleboo 1y ago
        You've never seen eduroam? https://en.wikipedia.org/wiki/Eduroam https://en.wikipedia.org/wiki/Eduroam
        BrandoElFollito 1y ago
        No - I have visited two universities in the past month in France and each of them has its own Wi-Fi logins and passwords. And then one more a few months ago in Poland. AHHHH - I just called a friend of mine at one of the French schools. He told me that this is for researchers only and thsi is why I was given another (permanent) access. I stand corrected and I apologize. This is actually awesome. Working in the field, this is probably one of the most interesting deployments I have seen over many years and I will have a close look at it now.
- jabroni_salad 1y ago
  I use an older ubiquiti edgerouter X so that would be pretty impressive.
akerl_ 1y ago
The only ways I can think of where this would be possible is if: 1. You're somehow connecting to Facebook and Amazon over HTTP, not HTTPS 2. Your browser has an extension from your ISP installed that's interfering with content 3. You've trusted a root CA from your ISP in your browser's trust store

Philip-J-Fry 1y ago

Pretty sure this is done on your router. They terminate TLS on your router, inject their malware and then re-encrypt.

notpushkin 1y ago
> and then re-encrypt How?
- tialaramex 1y ago
  One thing you can arrange is "Oh, you need to trust our Router's security thing" and so you're adding a new private root CA trust, then they "just" issue CA certs which they've arranged for you to trust. This is commonly how corporate and institutional systems are set up, it's a terrible idea but it's very common. One thing that helps drive it away at work is that we're a University, and essentially all the world's universities have a common authenticated WiFi (because students and perhaps more importantly, academics, just travel from one to another and expect stuff to work, if you got a degree in the last 20 or so years you likely used this, eduroam) but obviously they don't trust each other on this stuff so their sites all use the Web PKI, the same public trust as everybody else, internal stuff might not, but the moment you're asking some History professor to manually install a certificate you might as well assign them a dedicated IT person, so, everything facing ordinary users has public certs from, of course, Let's Encrypt. Edited to name eduroam specifically.
  - notpushkin 1y ago
    > This is commonly how corporate and institutional systems are set up, it's a terrible idea but it's very common. Tbh makes it kinda sense for those systems, when used only with internal tools and on company devices... but yeah I’d just (of course) Let’s Encrypt if I was setting it up for a client.
  - BrandoElFollito 1y ago
    Wrong information removed - you were right, I was wrong. I apologize.
    - kalleboo 1y ago
      You've never seen eduroam? https://en.wikipedia.org/wiki/Eduroam https://en.wikipedia.org/wiki/Eduroam
      - BrandoElFollito 1y ago
        No - I have visited two universities in the past month in France and each of them has its own Wi-Fi logins and passwords. And then one more a few months ago in Poland. AHHHH - I just called a friend of mine at one of the French schools. He told me that this is for researchers only and thsi is why I was given another (permanent) access. I stand corrected and I apologize. This is actually awesome. Working in the field, this is probably one of the most interesting deployments I have seen over many years and I will have a close look at it now.
jabroni_salad 1y ago
I use an older ubiquiti edgerouter X so that would be pretty impressive.

akerl_ 1y ago

The only ways I can think of where this would be possible is if: 1. You're somehow connecting to Facebook and Amazon over HTTP, not HTTPS 2. Your browser has an extension from your ISP installed that's interfering with content 3. You've trusted a root CA from your ISP in your browser's trust store