Hacker News Reader

"... was stealing usernames and passwords from common sites like Google Mail and Facebook".

Gmail always opens with SSL for me. Didn't Google make this the default after Chinagate?

Nope, at the time of these incidents, I could request GMail's login page over HTTP, though the login form action pointed to a HTTPS url. This was fixed a day or two later though. Same with Yahoo.

If you're the ISP, can't you fake ssl certs all the way down to the root?

sorry if i'm being ignorant

SSL certificates usually come with the OS or the browser. AFAIK there's no easy way for the ISP to add certificates.

Unless they are a government entity which is recognized as a certificate authority, or which can exert influence over one.

But there are millions of ways to provide you their version of firefox_installer.exe with the 'right' certificates.

Reply on news.ycombinator.com