3 ms·
HTTPS will not prevent this: the ISP can issue their own CA to their users and then decrypt/encrypt https as it passes through them. (Many corporations already
by bonaldi 14y ago
HTTPS will not prevent this: the ISP can issue their own CA to their users and then decrypt/encrypt https as it passes through them. (Many corporations already do this). What will prevent this is legislation and/or competition.
It amazes me that US Internet access has very little of either. All the drawbacks of monopoly Internet, with all the drawbacks of unregulated Internet.
- pellias 14y agoSlight correction, ISP or Corporation can run a HTTPS proxy. In effect, your 'HTTPS' connection is to the IPS/Corporate proxy only.
- peripitea 14y agoI'm confused as to how what you're saying or what parent is saying would work. The trusted CAs live on your computer, and should not be susceptible to tampering by your ISP. And how can your ISP or corporate network set up an HTTPS proxy like you're suggesting without triggering a warning to the user that they are not connecting to the SSL certificate's specified domain? Is there something about SSL/TLS that I'm fundamentally misunderstanding?
- deleted 14y ago[deleted]
- enginous 14y agoNope, you're right. The ISP would have to install the CA certificate on every device on the network, which is a nontrivial task. Furthermore, if the ISP has done that, they don't need you to go through a proxy. Your connection is already going directly through them. Edit: However (as you can see by some of the responses in this thread), there's certainly the possibility that your ISP itself is an actual certificate authority recognized by browsers. That scenario is indeed quite worrying.
- bonaldi 14y agoIt's also a pretty trivial task if you control the user's routers and can give them installation disks to make "the internet work". As corporate and university wifi shows, people will willingly accept new certificates required to join hotspots; they'll also do it on their desktops without blinking.
- enginous 14y agoIndeed, although I don't agree "internet-enabling software" is trivial in terms of engineering and support costs, considering the range of devices today. But mostly I just wanted to clarify on the point that interception is not fully transparent: that the ISP does need to compromise every device that connects to the network. But I do agree with your original point that to the extent possible, there should be legislation (if there isn't already) against intercepting TLS-encrypted connections of ISP customers, in cases where the ISP is also a browser-approved CA or is actually willing to distribute its own CA cert.
- laggyluke 14y agoI believe ISPs can not have a transparent HTTPS proxy without the "invalid certificate" browser warning. ISP users would have to manually trust their ISP's CA.
- bonaldi 14y agoOr have it added to their chain beforehand. An ISP could trivially include this as part of their "welcome pack" installer CD or the like. Would that silently affect people like us? No. Could they do it to all their non-technical customers? Absolutely.
- jamespo 14y agoNot going to help if their non-technical customers are using ipads or similar though, which non-technical users tend to like
- bonaldi 14y agoIOS gives you a friendly and official-looking "accept this certificate?" dialog when you connect to a router that offers one. Non-technical users will accept and proceed without blinking.