I wont go into much detail but ISPs can act as intermediaries in https calls and TLS would work only between you and the ISP and then ISP and the requested server. Software like Zscaler does similar stuff you can look it up if you want
I’m familiar. Other than key exchange for encrypted connections, the whole point of HTTPS/TLS is establishing who you’re connecting with is who they say they are and preventing man in the middle attacks just like you described.
If your traffic was being intercepted by something like Zscaler it wouldn’t be able to provide the proper signed certificate of that web address and your browser would throw a mismatch error. IT departments using such intermediaries for https traffic inspection only get around this by installing the intermediaries’ root CA on your system so it’s not flagged by your browser or whatever you’re using for TLS traffic.
The only way someone could intercept your TLS traffic and then pass it onto you without you knowing is by having that website’s private key to sign the traffic with, which is a major security breach. As soon as something like that is discovered the certificate is revoked and a new one is issued with a different private key.
Yeah… that’s not how TLS works.
I wont go into much detail but ISPs can act as intermediaries in https calls and TLS would work only between you and the ISP and then ISP and the requested server. Software like Zscaler does similar stuff you can look it up if you want
I’m familiar. Other than key exchange for encrypted connections, the whole point of HTTPS/TLS is establishing who you’re connecting with is who they say they are and preventing man in the middle attacks just like you described.
If your traffic was being intercepted by something like Zscaler it wouldn’t be able to provide the proper signed certificate of that web address and your browser would throw a mismatch error. IT departments using such intermediaries for https traffic inspection only get around this by installing the intermediaries’ root CA on your system so it’s not flagged by your browser or whatever you’re using for TLS traffic.
The only way someone could intercept your TLS traffic and then pass it onto you without you knowing is by having that website’s private key to sign the traffic with, which is a major security breach. As soon as something like that is discovered the certificate is revoked and a new one is issued with a different private key.
So, again, that’s just not how TLS works.
https://en.m.wikipedia.org/wiki/Public_key_infrastructure