Gogo inspects secure Web traffic in attempt to limit in-flight video streaming

In-flight Internet provider Gogo replaces the HTTPS certificates on sites like YouTube with self-signed ones

In-flight Internet provider Gogo is inspecting its users' traffic exchanged with secure sites by replacing those sites' HTTPS certificates with self-signed ones.

The company argues that this procedure, which is technically a man-in-the-middle (MitM) attack, is only performed for some video streaming sites as part of its efforts to limit or block the use of such services.

The issue came to light after Adrienne Porter Felt, an engineer and researcher with Google's Chrome security team, noticed a rogue HTTPS certificate when she tried to access youtube.com via Gogo's Wi-Fi service during a flight.

Porter Felt posted a screen shot of the certificate issued by Illinois-based Gogo on Twitter asking the company why it had replaced YouTube's real certificate. Her message sparked criticism of Gogo from other users.

The company responded Monday with a statement from its executive vice president and chief technology officer, Anand Chari.

"Right now, Gogo is working on many ways to bring more bandwidth to an aircraft," Chari said. "Until then, we have stated that we don't support various streaming video sites and utilize several techniques to limit/block video streaming. One of the recent off-the-shelf solutions that we use proxies secure video traffic to block it. Whatever technique we use to shape bandwidth, it impacts only some secure video streaming sites and does not affect general secure internet traffic. These techniques are used to assure that everyone who wants to access the Internet on a Gogo equipped plane will have a consistent browsing experience."

Chari assured customers that no user information is being collected when such techniques are applied -- an obvious concern with MitM traffic inspection. Because the company's proxy system is positioned between the user and the sites whose certificate it replaces, it can see authentication cookies that can provide access to users' accounts on those sites and other potentially sensitive information.

It's not clear how efficient the use of this man-in-the-middle technique is at limiting video streaming, nor if it's even necessary. When encountering a self-signed certificate, most browsers display an error and users have to manually agree that they want to continue to the website.

In the case of Google Chrome, which keeps a list of trusted certificates associated with popular sites, including youtube.com, as part of a mechanism called certificate pinning, the error is persistent and hard to bypass.

"Users can't normally click through this particular warning," Porter Felt said on Twitter. "You gotta know the secret sauce to force it to load the page."

This means that for many users YouTube streaming won't be just throttled, but completely blocked, and if that's what the company aimed for, there are easier ways to achieve it without inspecting secure traffic.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags online safetyGooglesecurityencryptionGogoprivacy

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?