SOPA sponsors return: "think of the children"

Re:SOPA sponsors return: "think of the children" by esteth on Sunday January 22, 2012 @12:52PM (#3497129)

I might be revealing my stupidity here, but surely your ISP can MITM the HTTPS handshake and decrypt all of your traffic? Unless you have a pre-arranged key that hasn't travelled through their network.

[ Parent | on HN ]

Re:SOPA sponsors return: "think of the children" by gergles on Sunday January 22, 2012 @01:03PM (#3497160)

Your ISP won't be able to get a trusted certificate authority to issue them a cert for "*", which is what they would need to do in order to transparently MITM SSL. They could generate that cert on their own, and maybe install it into the Windows cert store with the "installation CD", but they couldn't intercept your traffic on an unadulterated system.

[ Parent | on HN ]

Re:SOPA sponsors return: "think of the children" by vidarh on Sunday January 22, 2012 @01:03PM (#3497159)

SSL is designed so that only the server with the private key for a specific certificate can complete the handshake correctly for that certificate, and the certificate is tied to the domain name.

The ISP can MITM the handshake and return a different certificate, but unless a certificate authority supported by your browser is complicit, they can't get that certificate signed for the domain you're trying to visit, and the browser will complain.

[ Parent | on HN ]

Re:SOPA sponsors return: "think of the children" by ori_b on Sunday January 22, 2012 @01:12PM (#3497183)

I would expect that if the US government is requiring this, they'd also be able to get at least a few US based certificate authorities to play along.

[ Parent | on HN ]

Re:SOPA sponsors return: "think of the children" by vidarh on Sunday January 22, 2012 @01:17PM (#3497200)

If they did, we'd get versions of Firefox and Chromium at least with the US certificate authorities root certs yanked out within a day, and companies scrambling to replace their SSL certs with certs that'd still be trusted by users.

Unless they made it illegal to, I'm sure we'd see all the major browsers work to deprecate those certificate authorities pretty quickly - not doing so would make SSL useless.

[ Parent | on HN ]

Re:SOPA sponsors return: "think of the children" by keen on Sunday January 22, 2012 @04:08PM (#3497692)

I'm sure we'd see all the major browsers work to deprecate those certificate authorities pretty quickly

What about the recent Comodo breaches? Their certs are still trusted by all major browsers (as far as I'm aware).

I realise they weren't complicit in issuing the fraudulent certs, but the effect is the same.

[ Parent | on HN ]

Re:SOPA sponsors return: "think of the children" by ori_b on Thursday January 26, 2012 @03:19PM (#3515790)

Assuming that they bothered mentioning it.

[ Parent | on HN ]

Re:SOPA sponsors return: "think of the children" by ahelwer on Sunday January 22, 2012 @12:59PM (#3497148)

This is the purpose of certificates.

[ Parent | on HN ]

Re:SOPA sponsors return: "think of the children" by HoLyVieR on Sunday January 22, 2012 @01:05PM (#3497167)

The thing with certificate is that you have to trust that the certificate authorities won't sell (or give) fake certificate to ISP or government. If they do so, the ISP can MITM you.

[ Parent | on HN ]