Re:VPN use is at an all-time high – but are people safe?
by jsnell on Tuesday July 04, 2023 @10:20AM
(#36587078)
So, the original statement that companies like AT&T can trivially get root certificates and MITM TLS traffic is just crazy talk, and you were right to challenge that.
> The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page.
But this isn't really true either. There's a lot more that can be done with a packet stream than spy on DNS, even if the actual payload traffic is encrypted. A combination of DNS, SNI, IPs, and packet sizes and transmission patterns can allow fairly granular classification of traffic by type, and specific connections can then be traffic-shaped, e.g. by explicit throttling to some target bitrate or by applying differential QoS to them.
> The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page.
But this isn't really true either. There's a lot more that can be done with a packet stream than spy on DNS, even if the actual payload traffic is encrypted. A combination of DNS, SNI, IPs, and packet sizes and transmission patterns can allow fairly granular classification of traffic by type, and specific connections can then be traffic-shaped, e.g. by explicit throttling to some target bitrate or by applying differential QoS to them.