Hacker News Reader

Comment by actuator | Hacker News Reader

Surely, they can't be MITMing HTTPS traffic without Cloudflare's blessing?

Services not being available by region, that can be a bummer but that's not really a problem on internet service provider as such.

Also, I am surprised that one more country is building a GFW.

View on HN

It would be possible for an ISP to MITM the traffic between Cloudflare and the origin server since it can be configured to be done via unencrypted HTTP or non-trusted certs on HTTPS (flexible SSL). See https://medium.com/@karthikb351/airtel-is-sniffing-and-censo... for an example of Cloudflare serving a MITM notice page for pirate bay.

Yes, that or they just cut the connection to the origin entirely.

They can still do it, you'll just get a cert error. Also, if you're using a phone provided by them they could preload a CA they control.

That's interesting, I wonder if iOS/Android phones in China do something similar. I would be really surprised if Apple allows this.

There are a lot of reports of certificate issues (on Cloudflare) in Pakistan as well as Iran, with most of them likely because of censorship.

https://community.cloudflare.com/search?q=Pakistan

https://community.cloudflare.com/search?q=Iran

> surprised that one more country is building a GFW

Likely helped by China too, considering it's Pakistan

I would've bet money if Pakistan starts building a GFW, it would be with china's help but no, they bought equipment for this from an american company called Sandvine.

Reply on news.ycombinator.com