Timeline for How does VPN prevent Man In the Middle at the ISP level [duplicate]
Current License: CC BY-SA 4.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 14, 2020 at 23:20 | comment | added | browsermator | "You cannot fake a certificate" - I still find this statement hard to believe, and it seems somewhat contradictory to previous answers... but I'm far from an expert on this stuff and will take it on faith until I learn more. | |
| Feb 14, 2020 at 23:02 | comment | added | Steffen Ullrich | You cannot fake a certificate in VPN the same as you cannot do it in HTTPS. You would need to explicitly trust the CA which issued the fake certificate. But yes, explicitly trusting only a specific certificate removes any worry of the attacker using a different CA you also trust. You could do such direct trust with any certificate, self-signed or CA issued. | |
| Feb 14, 2020 at 22:23 | comment | added | browsermator | OK, I think I found what I needed from an answer to one of those previous questions: "For RSA, provision the client side of the VPN with the server certificate and don't rely on CAs. This means the server cert may be self signed." In this case it moves the level of trust directly to the VPN and it would be very hard to fake the cert? | |
| Feb 14, 2020 at 21:40 | history | duplicates list edited | Steffen Ullrich | duplicates list edited from Can ISP use MITM attack to "break" encrypted traffic?, How can Kazakhstan perform MITM attacks on all HTTPS traffic? to Can ISP use MITM attack to "break" encrypted traffic?, Is it possible for my ISP to do MITM attack on my VPN? [duplicate], How can Kazakhstan perform MITM attacks on all HTTPS traffic? | |
| Feb 14, 2020 at 21:39 | history | duplicates list edited | Steffen Ullrich | duplicates list edited from How can Kazakhstan perform MITM attacks on all HTTPS traffic? to Can ISP use MITM attack to "break" encrypted traffic?, How can Kazakhstan perform MITM attacks on all HTTPS traffic? | |
| Feb 14, 2020 at 21:30 | comment | added | Steffen Ullrich | "I guess the real question here is how does the guv'ment do it?" - This is answered in the one I marked for duplicate. The other question are as I already said confusing since you do strange switches between asking something about VPN but then focus instead on HTTPS - which means it is unclear what you really asked. | |
| Feb 14, 2020 at 21:28 | history | closed | Steffen Ullrich tls Users with the tls badge or a synonym can single-handedly close tls questions as duplicates and reopen them as needed. | Duplicate of How can Kazakhstan perform MITM attacks on all HTTPS traffic? | |
| Feb 14, 2020 at 21:13 | comment | added | Steffen Ullrich | "VPN prevents MITM at the ISP level... they can only see the destination domain but not the content." - this is wrong. HTTPS already prevents the ISP from seeing the content but he can see the destination domain from the TLS handshake. VPN encrypts everything including the TLS handshake so the ISP can only see that there is some VPN connection to some VPN endpoint but not what's going on inside. | |
| Feb 14, 2020 at 21:11 | comment | added | browsermator | I updated, but I guess I'm wondering of the truth of saying "VPN prevents MITM at the ISP level... they can only see the destination domain but not the content." | |
| Feb 14, 2020 at 21:10 | history | edited | browsermator | CC BY-SA 4.0 |
added 201 characters in body
|
| Feb 14, 2020 at 21:10 | comment | added | Steffen Ullrich | I'm confused about your question. In your title you ask how VPN prevents MITM. In the body you ask how the certificate in HTTPS prevents MITM. Please make clear what you really want to know. | |
| Feb 14, 2020 at 21:00 | review | First posts | |||
| Feb 14, 2020 at 21:25 | |||||
| Feb 14, 2020 at 20:57 | history | asked | browsermator | CC BY-SA 4.0 |