Re:Net neutrality is in jeopardy again
by manigandham on Monday May 08, 2017 @11:32AM
(#14292417)
How does that change how HTTPS works?
It doesn't, but the ISP still know what pages you went to.
If they want to determine your political leanings your browsing history is enough.
Re:Net neutrality is in jeopardy again
by manigandham on Monday May 08, 2017 @12:12PM
(#14292892)
How would the ISP know what pages you went to over HTTPS? Only the domain name would be available, through SNI/DNS.
They could just MITM all connections and say 'for compatibility reasons, please install this root certificate'.
With a fee, this requirement could then be waived.
Dystopian but technically possible.
Re:Net neutrality is in jeopardy again
by narrowrail on Monday May 08, 2017 @01:58PM
(#14293960)
This type of hypothetical drives me batty, and I was tempted to be snarky. I'm not sure how to respond to the idea that there will ever be a time your ISP requires root cert installation for service, but I will be finding a way to launch a WISP of my own at that point.
It's only slightly hypothetical.
http://www.csoonline.com/article/2865806/cloud-security/gogo...
Gogo didn't require installing a root cert, but they DID issue forged certificates to MitM connections to *.google.com (and others).
Also, remember "Superfish"? Their root cert was pre-installed by Lenovo.
My original was already snark. Though I don't think its impossible that a small amount of non-technical people might actually be convinced to do this.
Charge users extra fees for "premium service" unless they agree to let the ISP their traffic.