Re:Net neutrality is in jeopardy again
by manigandham on Monday May 08, 2017 @11:32AM
(#14292417)
How does that change how HTTPS works?
[ Parent
| on HN ]
It doesn't, but the ISP still know what pages you went to.
If they want to determine your political leanings your browsing history is enough.
Re:Net neutrality is in jeopardy again
by manigandham on Monday May 08, 2017 @12:12PM
(#14292892)
How would the ISP know what pages you went to over HTTPS? Only the domain name would be available, through SNI/DNS.
They could just MITM all connections and say 'for compatibility reasons, please install this root certificate'.
With a fee, this requirement could then be waived.
Dystopian but technically possible.
Re:Net neutrality is in jeopardy again
by narrowrail on Monday May 08, 2017 @01:58PM
(#14293960)
This type of hypothetical drives me batty, and I was tempted to be snarky. I'm not sure how to respond to the idea that there will ever be a time your ISP requires root cert installation for service, but I will be finding a way to launch a WISP of my own at that point.
It's only slightly hypothetical.
http://www.csoonline.com/article/2865806/cloud-security/gogo...
Gogo didn't require installing a root cert, but they DID issue forged certificates to MitM connections to *.google.com (and others).
Also, remember "Superfish"? Their root cert was pre-installed by Lenovo.
My original was already snark. Though I don't think its impossible that a small amount of non-technical people might actually be convinced to do this.