Subject: Re: [Add] Participation

From: "Smith, Kevin, Vodafone Group" <[email-masked]>
Date: Wed, 21 Aug 2019 16:49:57 +0000

Hello all,

I've confirmed with Vodafone UK's network and home broadband teams that they do not perform HTTPS interception/Man in the Middle.

The imgur issue is the result of DNS 53-based filtering. The error appears that the Vodafone root certificate (used to secure the user's configuration channel to the home router) was also used when the request was redirected to the secure 'warning page'  at the network proxy, apparently causing the browser to prompt 'add certificate to exception list'. The imgur issue was from January, the fix has been rolled out and I'm told that this certificate error should not happen anymore.

The NordVPN issue appears to be a user with content controls enabled at the router, which as I understand it may block certain VPNs based on DNS 53. I suspect they would simply disable the content controls to solve this.

So to confirm: no HTTPS interception/Man in the Middle in Vodafone UK.

All best,
Kevin

Mr Kevin Smith
Vodafone Group R&D

C2 General

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 21 Aug 2019 17:43:54 +0000

Thank you for the very clear update on this. The topic was starting to cause a lot of concern across the network.

--Paul Hoffman

---

From: [email-masked]
Date: Wed, 21 Aug 2019 17:52:37 +0000

On Wednesday, 21 August 2019, Paul Hoffman wrote:
> Thank you for the very clear update on this.

+1

S.

> The topic was starting to cause a lot of concern across the network.
> 
> --Paul Hoffman
> 
> -- 
> Add mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/add
>

---

From: "Smith, Kevin, Vodafone Group" <[email-masked]>
Date: Thu, 22 Aug 2019 13:12:48 +0000

You're welcome - I've also had an off-list question regarding URL-filtering, which I'm happy to post here with permission of the questioner:

"Could you please clarify how it is that Vodafone does the URL filtering, if not via MITM?
Do you block entire domains based on the domain part of URLs, or what technique do you use?"

My personal understanding is that most entries in the filter lists are domains without a URL path component, so DNS 53-based filtering is applied.

Any list entries that include a URL path component are only filtered if the path is visible to the network: i.e. not in the case of HTTPS, since there is no MitM.

Hope that helps.

Kevin
Vodafone Group R&D

C2 General

-----Original Message-----
From: [email-masked] <[email-masked]>
Sent: 21 August 2019 18:53
To: [email-masked]
Cc: [email-masked]; Smith, Kevin, Vodafone Group <[email-masked]>
Subject: Re: [Add] [Ext] Participation

+1

S.