3 ms·
No, it can be done wholesale. For example, a corporate firewall of the kind used in any large business will happily (and cheaply) MITM every TLS connection that
by CHY872 11y ago
No, it can be done wholesale. For example, a corporate firewall of the kind used in any large business will happily (and cheaply) MITM every TLS connection that goes through it. It'd be easy for an ISP to install such a device for unsigned certs, if the payoff were great enough.
ISPs have incentives too (advertising, user tracking, etc).
- bonjarber 11y agoYou are absolutely right that corporations do this. It's important to understand how this is happening though. In order to do so, they must add their own Certificate Authority to your browser so that it accepts a certificate signed by a non-root Certificate Authority as valid. This is easy to manage at a corporate level thanks to things like Active Directory that allow you to install root CA's in the browsers of your domain users. It is far more difficult for an ISP to install a non-root CA in your browser, therefore mitigating this risk.