Thread: https question
View Single Post
  #3 (permalink)  
Old 11-28-2008, 07:53 AM
David Woolley
Guest
 
Posts: n/a
Default Re: https question

not_here.5.species8350@xoxy.net wrote:
> Hi,
>
> https should ensure a secure connection beyween my pc and a server.
>
> But I am also connected to my ISP.
>
> Could the ISP read data sent to a server via https?


Not unless they have tampered with the browser that you are using, or
you failed to check that the SSL certificate being used for the session,
or at the least the URL you are actually using, actually belongs to the
organisation that you are communicating with. (The biggest flaw in SSL
is that most people do not check this, and even fewer check that the
root certificate used offers an adequate level of authentication for the
use to which it is being put.)

This makes the, reasonable, assumption that your ISP is not one of the
official root certificate providers for your browser, and, of course,
that they are unconnected with the site you are using.

Reply With Quote