Hacker News Reader

If you're the ISP, can't you fake ssl certs all the way down to the root?

sorry if i'm being ignorant

SSL certificates usually come with the OS or the browser. AFAIK there's no easy way for the ISP to add certificates.

Unless they are a government entity which is recognized as a certificate authority, or which can exert influence over one.

But there are millions of ways to provide you their version of firefox_installer.exe with the 'right' certificates.