6

Provided I have not set cache-control header to private, can ISPs cache web pages (by respecting max-age) served over HTTPS?

Sorry if I sound naive, but I wanted to know if ISPs somehow can cache and relay without intercepting/decrypting.

Improve this question
1
  • 9
    ISPs are not the only thing you need to worry about, caching can also take place in the CDN level and the browser level.
    – Stephen Ostermiller ♦
    Commented May 28, 2021 at 17:32

2 Answers 2

Reset to default
17

If they provide an HTTP proxy service you use, they can cache on the fly.

If they do not pervert the HTTPS stream (which starts by changing the server certificate exposed and/or changing the CAs you trust on your client device) they have no way to see the content, hence they have nothing to cache.

Improve this answer
7

SSL/TLS is a transport encryption standard. It hides the entire communication between client and server. So decryption of the transport encryption* is a prerequisite to caching.

Intercepting SSL/TLS is something that does happen, but mostly on private networks or by ISPs in totalitarian regimes. It's not something that can really be done without users noticing as users will have to install a special root certificate on the client devices.

Another thing that increasingly happens for media content is that site owners partner with CDNs and those CDNs in turn place distribution servers into ISP networks. Since this happens with the approval and cooperation of the site operator, legitimate certificates can be presented.

* Of course there may be other layers of encryption, for example a TV stream may be encrypted by the DRM system, then encrypted again by the transport encryption.

Improve this answer
5
  • Your answer is mainly correct, except the first statement. The domain name of the website is not hidden in the initial communication - which is required for name based ssl hosting which is ubiquitous.
    – davidgo
    Commented May 29, 2021 at 7:55
  • "It's not something that can really be done without users noticing" – Slight nitpick: I think it would by slightly more correct to say "It's not something that can really be done without administrators noticing". In the home context, user and administrator are the same, but in corporate contexts, user and administrator are different, which is precisely why it is possible to install MitM root certificates without cooperation of the user.
    – Jörg W Mittag
    Commented May 29, 2021 at 15:35
  • @davidgo Actually, it depends. There's a protocol extension (iirc) that hides it, however it's not very common (and can cause your traffic to be dropped).
    – wizzwizz4
    Commented May 29, 2021 at 16:51
  • 1
    @davidgo "The domain name of the website is not hidden in the initial communication - which is required for name based ssl hosting which is ubiquitous. " That is soon about to change with ECH (previously ESNI), even the SNI information in the TLS first steps will be encrypted.
    – Patrick Mevzek
    Commented May 29, 2021 at 19:08
  • 1
    @wizzwizz4 "however it's not very common (and can cause your traffic to be dropped). " It is for TLS 1.3 and indeed some countries already said they will filter it. It is not yet common because it is not fully standardized yet, and it needs the proper DNS HTTPS / SVCB records that are being worked on right now.
    – Patrick Mevzek
    Commented May 29, 2021 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.