2

I know that some ISPs send block pages(like "This site has been blocked because ... ") over HTTP by sending a fake 301/302 redirect.

I also know that instead of sending a block page, some ISPs simple send RST to terminate the connection or do nasty things with DNS when blocking an HTTPS site.

But can they send a block page over HTTPS? And if possible, I'd like to know some other methods of blocking sites(both HTTP and HTTPS).

  • No one can intercept an HTTPS page without you having to manually install a root certificate. – forest May 22 at 19:27
  • So that means they can't just forge a redirect into HTTPS traffic? – cynoob2 May 22 at 19:40
  • Correct. See my new answer. – forest May 22 at 19:44
3

ISPs cannot inject their own pages into HTTPS traffic. They can block the traffic and cause the page to fail to load, or they can attempt to hijack a HTTP->HTTPS redirect before the encrypted connection is made, but they cannot modify the contents of the page itself once the connection is established. The only way for them to do this would be if you had installed a root certificate made by them, effectively telling your browser to trust your ISP act as a Certificate Authority for arbitrary websites (a bad idea).

  • could you please explain what do you mean by hijacking a http->https redirect? – cynoob2 May 22 at 19:45
  • @cynoob2 When you connect to an HTTP site, the site might redirect you to the HTTPS version of the site automatically. An ISP could hijack this redirection. – forest May 22 at 19:45
  • Oh I see. Thank you very much, I got the gist of it. – cynoob2 May 22 at 19:46
  • This won't work if the site uses HSTS, however. – gparyani May 22 at 23:17
  • don't quite a few ISPs require you to install their root certificates when you use their modems? (Which they also require you to rent from them)? – Magisch May 23 at 6:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.