I think you've misunderstood what whyleyc wrote above. OP asked why GoGo doesn't just "blacklist" ie censor the mentioned sites via DNS, explicitly excluding a

I think you've misunderstood what whyleyc wrote above. OP asked why GoGo doesn't just "blacklist" ie censor the mentioned sites via DNS, explicitly excluding a MITM attack: > Why are they even pulling this MITM trick in the first place ? > Can't GoGo just "blacklist" streaming sites at a DNS level and deal with the problem before a connection is even made to a high-bandwith destination ? So no MITM, just GFW of China style blocking. Which is trivial for unencrypted packets like DNSSEC. Observe, by the way, that China supports DNSSEC -- it's not a problem for them! http://dnsviz.net/d/cn/dnssec/ http://dnsviz.net/d/cn/dnssec/ And it wouldn't be a problem for GoGo, either, because DNSSEC is not encrypted and blacklisted sites can be dropped on the floor. Or GoGo could trivially return SERVFAIL. But the whole thing is moot anyway because youtube.com doesn't support DNSSEC and probably never will.