As someone who is not an InfoSec professional, I am surprised that the wider security community very rarely discusses the inadequacies of HTTPS/TLS.
In my opinion, insecurity of HTTPS/TLS against MITM attacks is a giant elephant in the room.
Could somebody please confirm that I am correct in thinking that modern HTTPS/TLS is very insecure against MITM attacks on ISP/Proxy Service level, and there exists a potential solution?
Why HTTPS/TLS is insecure
While your connection to a server may be encrypted and tamper-proof, anyone with adequate resources can place a MITM machine between you and the public website's server.
So long as MITM machine has a valid certificate chain, it can then show your browser a fake version of the website, or even modify the data being sent back and forth.
This issue is exacerbated by the fact that there are now free certificates available from companies like Cloudflare and Let's Encrypt. So, it very easy for MITM machines to get valid certificate chains.
All networked computers should record the history of received TLS certificates per public website and send it to a public database for attestation. This would allow users to compare the fingerprints of certificates by different geolocations and potentially uncover any MITM attacks. Although this is not a complete solution, it would at least give users some indication of whether or not they have been the victim of a MITM attack.
Am I correct in my assessment of HTTPS/TLS being insecure against MITM attacks on ISP/Proxy Service level?
Is there any third-party that provides such TLS certificate attestation service? I find it hard to believe that nobody has created a certificate attestation SaaS, what am I missing here?