4

I'm learning about encryption and SSL certificates and I'm wondering: If an encrypted connection is used when connecting to a website using a SSL certificate, how can ISP/company manager/government (whoever controls the network traffic) block some specific content of that website?.

I know from this question that an entire website/domain(IP address) can be blocked since the server IP is not encrypted at the TCP layer, otherwise no way to make a connection!. But since an encrypted connection is established, all data traffic is encrypted - including the request headers (like URL header) -, So ISP's don't know if the request is for

https://www.example.com/good-content

or for

https://www.example.com/bad-content

because the entire URL is encrypted along with the entire request to the receptionist.

My problem now is, how could some ISP's block some videos on YouTube about 4 years ago?.

I wasn't aware of something called encryption 4 years ago to think about it, but now I'm trying to understand what was going on that time.

The only Explanation I could come up with Is that YouTube was allowing http requests at that time . So an http request to

 http://www.youtube.com/watch?v=bad-content

can be blocked , but a an https request to the same URL can not be blocked because the ISP doesn't know what is being watch!. I don't know if my explanation is right or wrong, but I hope I can understand.

  • 2
    Generally speaking, this is not possible (without breaking the encryption). – Lukas Jul 31 '17 at 17:40
2

Two things come to mind here:

  1. ISP requires certificates from them to be installed on your computer prior to allowing you to access the net. In this dystopian environment (which does exist in some countries and many corporate networks), the ISP would require you add their certificate to your trusted root store before accessing network resources. When your request is made to https://someplace.com/any-content, a proxy performs a man-in-the-middle, decrypts the traffic, and re-encrypts it on the fly with the certificate for the root store. This would allow them to decrypt traffic and perform a MITM to inspect your traffic.

  2. ISP Blocks domain names ISPs can block and filter DNS requests to somesite.com at will. Granted, this would block https://somesite.com/good-content and https://somesite.com/bad-content as well.

  • Thanks. do you mean like the fiddlerRoot certificate that you install if you want to debug a https connection using fiddler ? – AccountantM Jul 31 '17 at 14:45
  • 1
    That's an example, because it does decryption on-the-fly like #1 above. However, I am not sure of the specifics about fiddler. Since it's so popular, I would imagine that it generates its own cert upon installation (trivial to do) otherwise, hackers would use that for all their attacks. It would be more obvious if you had to "install software" in order to access an ISP's network. In the late 90's, US ISPs had software you installed to access their networks, which (mostly) registered your Mac address, which is why routers have a mac address masquerade feature. So, the practice is not unheard of – DrDamnit Aug 1 '17 at 15:06
1

While I can't answer about youtube 4 years ago, I can talk about SSL/TLS.

When you open a TLS connection to a server you may (and usually do) specify what name you are trying to reach, this is called Server Name Indication (SNI).

So your ISP knows:

  • the IP you are connecting to, and
  • the name you are trying to connect to.

The full URL (as you said) is encrypted, but knowing the servername may be enough censor the full site.

  • 1
    Thank you for the useful answer. So does this mean that if a website (You Tube for example) uses https exclusively, no one -in the middle- can know which content/video the users are watching? – AccountantM Jul 30 '17 at 21:23
  • @Accountant that is correct. – Kevin Voorn Jul 30 '17 at 22:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.