A firewall/router can intercept HTTPS traffic, analyse it and detect suspicious file download for example. From my understanding, it is acting as a proxy and/or a MITM device.

If it is capable of doing this, ISPs, Governments or whoever can read HTTPS traffic, right?

That's my first concern. The second one is how firewalls can do that? As it's not required to install any certificate from the device on a PC.

  • 1
    So much to unpack here. I encourage you to confirm some of these assumptions before asking questions based on them. Just because your local firewall can inspect traffic does not mean any node on the network can (like ISPs). To inspect the traffic, yes, the client needs to install a certificate. Please explain the situation where you do not have to install a certificate to break SSL. – schroeder May 28 '19 at 21:53
  • The most the device can do without you installing its root CA cert is to look at SNI to get domain name and look at flow to esitimate response size and timing. This way it is possible to guess client is downloading particular file, reading particular wikipedia article, watching particular movie on netflix. For well known content the inspection device "knows" (possibly using cloud database). – Z.T. May 28 '19 at 22:16

The point of a firewall is that it creates a boundary between internal and external. Traffic going through the firewall passes from internal to external. So for all intents and purposes, consider the firewall to be wholly internal except for the 2-dimensional plane that is public-facing; in other words, the network is internal including the firewall up to and excluding the firewall’s doors.

As a result, everything authoritative the firewall does with regard to the network (and again, I’m simplifying) is within that internal boundary. And we can assume the internal network operates at a high trust level such that privileged entities within the boundary (such as a firewall) can see and control certain aspects of traffic without breaking CIA.

The threat actors you’re describing here (governments and so on) are external. Outside of the network, nothing can be more privileged than anything else. So to answer your question, as far as at least the civilian population is aware, no, it’s not possible for external parties to interact with public traffic as though it were a firewall.

Does that make sense? Comment if you have any other questions. I think there might be some core concepts here that would be good to research and review, including network fundamentals and how HTTPS works.

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.