Gogo injects false SSL certificates for google.com domains
1–10 of 52 posts
Re: Gogo injects false SSL certificates for google.com domains
#2Random guess - this is probably because many people have a their homepage as a SSL'd google site. In order to be able to show the "login or pay" message to someone when they fire up their browser, Gogo needs to have a cert to communicate over 443 without the browser refusing to display a page.
Not condoning the practice, but thats my guess at the motivation. I also imagine it doesn't work very well, as many new browsers will refuse to display if the cert chain is broken.
Re: Gogo injects false SSL certificates for google.com domains
#3Random guess - this is probably because many people have a their homepage as a SSL'd google site. In order to be able to show the "login or pay" message to someone when they fire up their browser, Gogo needs to have a cert to communicate over 443 without the browser refusing to display a page. Not condoning the practice, but thats my guess at the motivation. I also imagine it doesn't work very well, as many new brows…
My samsung tablet is aware of login and opens browser after it connects to wireless network.
My guess is caching (thats in airplane).
Re: Gogo injects false SSL certificates for google.com domains
#4I said this on reddit as well: could this just be them trying to block YouTube and other streaming services?
Re: Gogo injects false SSL certificates for google.com domains
#5I said this on reddit as well: could this just be them trying to block YouTube and other streaming services?
I'm pretty confident that this is the answer. Their attempts to break said services only work intermittently, however.
Re: Gogo injects false SSL certificates for google.com domains
#6Random guess - this is probably because many people have a their homepage as a SSL'd google site. In order to be able to show the "login or pay" message to someone when they fire up their browser, Gogo needs to have a cert to communicate over 443 without the browser refusing to display a page. Not condoning the practice, but thats my guess at the motivation. I also imagine it doesn't work very well, as many new brows…
My samsung tablet is aware of login and opens browser after it connects to wireless network. My guess is caching (thats in airplane).
Apple does the same thing (apparently they request https://www.apple.com/library/test/success.html and see if it returns the correct SSL and contents).
Re: Gogo injects false SSL certificates for google.com domains
#7I said this on reddit as well: could this just be them trying to block YouTube and other streaming services?
If that was the motivation, why would they redirect to a server with a falsified certificate instead of just dropping the connection?
Re: Gogo injects false SSL certificates for google.com domains
#8Imagine if Gogo gets compromised and that cert is stolen. Suppose it will end up on a CRL or just quietly replaced?
Re: Gogo injects false SSL certificates for google.com domains
#9I said this on reddit as well: could this just be them trying to block YouTube and other streaming services?
I doubt this is them trying to block YouTube.
The certificate has SAN entries for things like google-analytics.com, android.com, *.cloud.google.com, goo.gl, g.co, urchin.com, and a plethora more[0].
If they wanted to just block YouTube, there are ways to do that without forging certificates. For example, modern browsers will send the domain name in plain-text even for HTTPS connections for SNI to function. They could easily block based on that.
Re: Gogo injects false SSL certificates for google.com domains
#10This is SOP at many employers that want to snoop use of their private Internet feed.