5 ms·

> No notification What ISP? I'm using Vodafone and if I accept the insecure connection (because of mismatched certificate), I get served the notification. You

> No notification What ISP? I'm using Vodafone and if I accept the insecure connection (because of mismatched certificate), I get served the notification. You don't get that?

tomnipotent 6mo ago
Presumes you're using the ISP's DNS and not custom servers or DoH.
- embedding-shape 6mo ago
  Bit hard to get notified by the ISP if you effectively try to side-step the way they notify you, don't you think? Also bit weird to blame them for that. If I recall correctly, if you try to access the IP directly you get the same notification. No football game on right now though so cannot check. Edit: In fact, I'm not sure they do DNS filtering at all actually, it may be just based on IP, can't remember off-hand, considering the collateral damage, I'd say IP blocks mainly.
  - deleted 6mo ago
    [deleted]
  - mzajc 6mo ago
    ISPs have your contact information, and they can also put up notices on their own website. Hijacking somebody else's website with forged replies isn't "the way they notify you," it's a man-in-the-middle attack, and users shouldn't be trained or encouraged to accept it.
    - embedding-shape 6mo ago
      > ISPs have your contact information, and they can also put up notices on their own website. So whenever you see "Connection Refused" your instinct is to go to your ISPs website? I also don't think it's "hijacking someone's website", then it'd be global, instead it is a man-in-the-middle attack, serving different traffic than the user intended.
  - devmor 6mo ago
    Hijacking secured connections to inject a payload that doesn’t actually come from the source is not a legitimate form of notification - it’s a malicious infrastructure attack.
brian-armstrong 6mo ago
Why would you ever accept a mismatched certificate? Even assuming that you think your ISP has no nefarious plans, are you going to be able to rigorously confirm it's their certificate? At that point you've bypassed all the mechanisms in your browser that do this heavy lifting for you.
- embedding-shape 6mo ago
  Why wouldn't you? Your computer is not gonna be hijacked by it, and you want to see what shit your ISP is now up to. Obviously I don't do my banking like that...
- lukan 6mo ago
  Erm, where is the danger in a mismatched certificate, if all I want is to get some noncritical information from a blog or something?
  - eggprices 6mo ago
    Local privilege escalation in your browser is a danger. They can also abuse any privileges you gave to the website, such as camera and microphone.
    - lukan 6mo ago
      Why would I give a "random blog" access to my camera or microphon? And how can a wrong certificate lead to local privilege escalation?

> No notification What ISP? I'm using Vodafone and if I accept the insecure connection (because of mismatched certificate), I get served the notification. You don't get that?

tomnipotent 6mo ago

Presumes you're using the ISP's DNS and not custom servers or DoH.

embedding-shape 6mo ago
Bit hard to get notified by the ISP if you effectively try to side-step the way they notify you, don't you think? Also bit weird to blame them for that. If I recall correctly, if you try to access the IP directly you get the same notification. No football game on right now though so cannot check. Edit: In fact, I'm not sure they do DNS filtering at all actually, it may be just based on IP, can't remember off-hand, considering the collateral damage, I'd say IP blocks mainly.
- deleted 6mo ago
  [deleted]
- mzajc 6mo ago
  ISPs have your contact information, and they can also put up notices on their own website. Hijacking somebody else's website with forged replies isn't "the way they notify you," it's a man-in-the-middle attack, and users shouldn't be trained or encouraged to accept it.
  - embedding-shape 6mo ago
    > ISPs have your contact information, and they can also put up notices on their own website. So whenever you see "Connection Refused" your instinct is to go to your ISPs website? I also don't think it's "hijacking someone's website", then it'd be global, instead it is a man-in-the-middle attack, serving different traffic than the user intended.
- devmor 6mo ago
  Hijacking secured connections to inject a payload that doesn’t actually come from the source is not a legitimate form of notification - it’s a malicious infrastructure attack.

brian-armstrong 6mo ago

Why would you ever accept a mismatched certificate? Even assuming that you think your ISP has no nefarious plans, are you going to be able to rigorously confirm it's their certificate? At that point you've bypassed all the mechanisms in your browser that do this heavy lifting for you.

embedding-shape 6mo ago
Why wouldn't you? Your computer is not gonna be hijacked by it, and you want to see what shit your ISP is now up to. Obviously I don't do my banking like that...
lukan 6mo ago
Erm, where is the danger in a mismatched certificate, if all I want is to get some noncritical information from a blog or something?
- eggprices 6mo ago
  Local privilege escalation in your browser is a danger. They can also abuse any privileges you gave to the website, such as camera and microphone.
  - lukan 6mo ago
    Why would I give a "random blog" access to my camera or microphon? And how can a wrong certificate lead to local privilege escalation?