3

I know that some ISPs send block pages(like "This site has been blocked because ... ") over HTTP by sending a fake 301/302 redirect.

I also know that instead of sending a block page, some ISPs simple send RST to terminate the connection or do nasty things with DNS when blocking an HTTPS site.

But can they send a block page over HTTPS? And if possible, I'd like to know some other methods of blocking sites(both HTTP and HTTPS).

Improve this question
3
  • No one can intercept an HTTPS page without you having to manually install a root certificate.
    – forest
    May 22, 2019 at 19:27
  • So that means they can't just forge a redirect into HTTPS traffic?
    – cynoob2
    May 22, 2019 at 19:40
  • Correct. See my new answer.
    – forest
    May 22, 2019 at 19:44

1 Answer 1

Reset to default
3

ISPs cannot inject their own pages into HTTPS traffic. They can block the traffic and cause the page to fail to load, or they can attempt to hijack a HTTP->HTTPS redirect before the encrypted connection is made, but they cannot modify the contents of the page itself once the connection is established. The only way for them to do this would be if you had installed a root certificate made by them, effectively telling your browser to trust your ISP act as a Certificate Authority for arbitrary websites (a bad idea).

Improve this answer
10
  • could you please explain what do you mean by hijacking a http->https redirect?
    – cynoob2
    May 22, 2019 at 19:45
  • @cynoob2 When you connect to an HTTP site, the site might redirect you to the HTTPS version of the site automatically. An ISP could hijack this redirection.
    – forest
    May 22, 2019 at 19:45
  • Oh I see. Thank you very much, I got the gist of it.
    – cynoob2
    May 22, 2019 at 19:46
  • This won't work if the site uses HSTS, however.
    – gparyani
    May 22, 2019 at 23:17
  • don't quite a few ISPs require you to install their root certificates when you use their modems? (Which they also require you to rent from them)?
    – Magisch
    May 23, 2019 at 6:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .