Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-08 Thread Jon Callas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Jan 8, 2015, at 3:37 PM, John Levine jo...@iecc.com wrote: Do the fake certs validate in web browsers? No, they do not validate. If you go (went) to a Youtube, Vimeo, etc. site, URL, embedded whatever, you'd get the expected browser

Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-08 Thread Patrick Mylund Nielsen
On Thu, Jan 8, 2015 at 6:35 PM, Jon Callas j...@callas.org wrote: Well, I'll be. I am on a Gogo-enabled flight even as we squeak, and I just turned my VPN off to go get you one of their certs. They're letting me get to YouTube and Vimeo just fine now. I guess someone got some sense. It was

Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-08 Thread Jon Callas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Jan 6, 2015, at 8:34 AM, shawn wilson ag4ve...@gmail.com wrote: You can smartly limit resolution in squid - I don't trust this is what they were doing, but you could provide a better experience like this. It is what they are doing. I am an

Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-08 Thread John Levine
It is what they are doing. I am an unhappy (for many reasons) regular (for many other reasons) Gogo customer, and noticed pretty quickly when they started doing it. I looked at their certs and it's an awful-user-experience way of blocking videos, and I strongly suspect that the rotten user

Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-06 Thread Nathan Dorfman
On Tue, Jan 6, 2015 at 11:34 AM, shawn wilson ag4ve...@gmail.com wrote: You can smartly limit resolution in squid - I don't trust this is what they were doing, but you could provide a better experience like this. This may be just barely worth mentioning, but still: Gogo was, less than a year

Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-06 Thread Jeffrey Altman
On 1/5/2015 8:47 PM, John Levine wrote: http://venturebeat.com/2015/01/05/gogo-in-flight-internet-says-it-issues-fake-ssl-certificates-to-throttle-video-streaming/ They claim they're doing it to throttle video streaming, not to be evil. Am I missing something, or is this stupid? If they

Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-06 Thread Seth
On Tue, 06 Jan 2015 14:37:37 -0800, Nathan Dorfman n...@rtfm.net wrote: Gonna go out on a limb here and strongly suggest not trusting any *.google.com certificate signed by these guys. Has anyone on the list had success running the Tor Browser Bundle over a Gogo in flight connection?

Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-06 Thread Peter Maxwell
On 6 January 2015 at 15:40, Jeffrey Altman jalt...@secure-endpoints.com wrote: On 1/5/2015 8:47 PM, John Levine wrote: http://venturebeat.com/2015/01/05/gogo-in-flight-internet-says-it-issues-fake-ssl-certificates-to-throttle-video-streaming/ They claim they're doing it to throttle

Re: [cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-06 Thread shawn wilson
You can smartly limit resolution in squid - I don't trust this is what they were doing, but you could provide a better experience like this. On Tue, Jan 6, 2015 at 11:01 AM, Peter Maxwell pe...@allicient.co.uk wrote: On 6 January 2015 at 15:40, Jeffrey Altman jalt...@secure-endpoints.com

[cryptography] Gogo inflight Internet uses fake SSL certs to MITM their users

2015-01-05 Thread John Levine
http://venturebeat.com/2015/01/05/gogo-in-flight-internet-says-it-issues-fake-ssl-certificates-to-throttle-video-streaming/ They claim they're doing it to throttle video streaming, not to be evil. Am I missing something, or is this stupid? If they want to throttle user bandwidth (not