Website security certificate coming from vodafone content control even though it's off.

[Will]

Hi @lizzyleon and @dm319

We'll need to ask the Broadband team to look into these for you. I'm going to send you both a private message with our contact details. Once you've completed the forms, we'll send the information to the team and they'll investigate this further and get some answers for you.

[SpyingOnYou]

Okay to clear this up for all the people dealing with these non-answers.

First.

DO NOT ADD AN EXCEPTION TO YOUR BROWSERS SECURITY

DO NOT FOLLOW THE WORK-AROUND ADVISE HERE!!! 

Second.

They are MiTM'ing your connection so they can see everything you visit. This allows them to control what you have access to, while also informing governments of your browsing habits.

I fully expect this to be deleted, but you should be starting a Class-Action Lawsuit against them for this.

[SpyingOnYou]

They will say this is to monitor bandwidth usage, "to ensure a quality service".

However in the process they're compromising your security and privacy. For the bucks. This is not acceptable. You should not accept it.

[KD]

Hi all

This has been investigated by our support teams and they've confirmed:

As part of Vodafone’s commitment to ensuring your safety on the internet we work with the Internet Watch Foundation (IWF) to monitor websites and domains that contain offensive content.  Unfortunately imgur.com has currently been flagged as one such website.  Our current content controls means that HTTPS traffic to this website will appear to be insecure.  We are working on a solution with our vendor that will ensure that HTTPS traffic will work normally in the future.  Vodafone’s content control platform does not monitor or log your internet traffic.

[piotrek]

Workaround provided by Vodafone staff will not work.

There is a workaround which is working, but you need to be a bit technical: you need to log in to your router page: http://vodafone.connect or usually 192.168.1.1 and then change the DNS servers (Internet tabe -> DNS & DDNS - you will need to switch to 'Expert mode' to see that link) - and then use any DNS servers, but I recommend the google ones: 8.8.8.8 and 8.8.4.4.

[jaysto]

I am a new customer also struggling to work around this - it is frankly baffling that Imgur is blocked - and to see that this has been an issue for more than a year is a worrying sign.

When can we expect this to be resolved? 

[ChazzD]

@jaysto

We're working on a solution with our vendor that will ensure that HTTPS traffic will work normally in the future. 

We don't have an expected timescale for this at the moment. When we do have an update, we'll update this thread. 

[MIKEMOLLOY]

Hi All

Just thought i'd add my 2 cents here.

I have been a Vodaphone broadband customer on the 75Mbps line for a few months now and have recently noticed this happens with my Mediafire Cloud storage subscription.

Tried with Chrome and Firefox and the same message as reported here where the content control url is repeated 20 times in the address bar.

Have 'escalated' it with Vodaphone and Mediafire, each sort of blames the other but no one has a fix.  

Content control is off etc before and 1st line supports send me that workaround.

Have asked for someone more senior to get in touch with so i'll repost anything if I get to talk to anyone.

[Tash]

Hi @MIKEMOLLOY,

Please keep us updated on this.

As @ChazzD has mentioned, we'll also update the thread with any further information we have on this.

[SpyingOnYou2]

Stop misinforming your customers.

* This invalid certificate is being issued for the purposes of censorship and monitoring.  

* Vodafone's partnes are eavesdropping on what should be secure encrypted connections.  

* This reduces online safety of all Vodafone users.  

* Training users to add exceptions for invalid certificates as a "work-around", teaches them to be Man-in-the-middle attack victims.  

If you're affected by this exploit of your privacy, switch off Vodafone DNS servers.

Google DNS:

8.8.8.8

8.8.4.4

Vodafone: Stop turning your customers into victims.

[SpyingOnYou2]

Also this garbage about "working on a solution that allows us to spy on your encrypted connections while still being use encryption" is nothing but delusional.

You can't break encryption without breaking encryption.

Stop doing this to your users. If it's a legal situation, fight back instead of enabling.

[bentaggartryan]

Hi all,

i've just got Vodafone broadband and are having a similar issue to the one mentioned above.

Imgur seems to work oknon my laptop and in chrome on my phone but using their app I get a error message which reads:

'The certificate for this service is invalid. You might be connecting to a server that is pretending to be ''i.imgur.com'' which could put your confidential information at risk.'

Can anyone help me stop this from happening or explain how to do a work around?

thanks

[ChazzD]

@bentaggartryan

Please speak with our Broadband team via Live Chat or on 08080 044 848 for help with your query. 

[cr3]

This is hilariously unacceptable.

The DNS workaround above works fine. Google DNS is anycast and should be nice and fast, you won't notice anything being worse.

Before: Ping imgur, whois the IP, it's Vodafone, MITMing your connection

After: Ping imgur, whois the IP, it's Fastly (which is Imgur infrastructure), which is correct

Good lord.

[kovacs]

Absolutely appalling service by Vodafone. December 2015, a moderator ( so long ago he's now retired ) claims he's notified the 'relevant team' and will chase them up. Since then various other moderators have said the same thing. 18 months later and Vodafone care so little about their customers, they have done nothing to resolve this issue. And the whole time, we are paying full price and are unable to access the internet properly.  Pathetic.

[ChazzD]

@kovacs

Please use the information provided earlier in the thread to contact the Broadband team for help with this. 

[kovacs]

And this will have a different outcome to all the other people on here who have been asked to do exactly the same thing?

[Tash]

@kovacs The dedicated Broadband team will be able to investigate this further. Please let us know how you get on after speaking with them.

[kovacs]

Well I already have.  I spoke to them a month ago.  And nothing has changed - just like nothing has been done for 18 months because Vodafone couldn't care less.  Every other ISP I try at friends  / family works fine.  Vodafone are quite content taking money off people for what essentially is a broken service.  Otherwise, how can you explain the current situation?

[Alex]

@kovacs Apologies for the inconvenience, our support teams are still looking into this issue.

I've chased this with our specialists and a member of the team will update this thread as soon as we hear back.