2

Recently I noticied that some of social networks (ex. twitter) domains points to an IP in my local ISP. (ping twitter.com resolved to local ip: 3.4.5.6-static.bad-government-isp.com).

Note: now twitter.com resolves to IP in USA.

I understand that cdn can be hosted locally, but I thought that the main https connection should be served from some-centralized-twitter-datacenter.

The certificates were correct and firefox (latest version with certificate patrol) didn't complain about anything.

From the news, I read that government lately purchased new surveillance software (after hacking team scandal).

Is this normal? Or the ISP is doing some smart man in the middle?

1

The IP address is unrelated to the certificate and thus does not matter when validating the certificate.

It might be that your ISP answered the DNS query with an IP address of an interception device and that the interception device than decided to simply forward the data unchanged to the original target (which can be read from the ClientHello of the SSL handshake) after checking it against some kind of blacklist.

The integrity of the SSL connection itself would not be harmed in this case but of course the ISP might have logged the access. But be aware that SSL only provides protection against sniffing and modifying the data and does not provide privacy, i.e. anybody sniffing on the line can see where you connect to and how many data gets transferred.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.