What can the company running a kosher Internet filter see?

I am a little concerned about something I was reading the other day. I was always under the impression that Internet filters worked by either a “whitelist” of websites that are allowed, blocking all others, or by just sending the list of visited websites to a shomer. But I’ve heard that some new kosher Internet Service Providers (ISP) are requiring full unrestricted access to everything. (I’ll write up the technical details in the bottom paragraph if that’s something you’re interested int). This is really worrying to me. Not only do they see what websites you visit and what content is on those websites, but they have all of your passwords, can read all of your emails, bank statements, access online purchases, credit cards, etc. This is extremely problematic for people who are running home businesses, do you really want Shprintze the IT person at KTech to look be able to look at your medical history?

In my opinion, these companies need to offer a course in Internet safety when people sign up for it. And not just safety in terms of not using the Internet for divrei tumah, but knowing that any and all information you put online will end up in the hands of someone who you don’t want to have it.

And now for a watered down version of the technical side, skip this if it bores you.

If you know computers, what they are doing is installing their own root cert authority on the users computer then overwriting the root CA with their own.

To explain for the layman:

Most Internet connections are secure. What that means, is that when you connect to a website, email server, VPN, or whatnot, the two computers that connect exchange encryption locks. These locks are then used to encrypt the data before its sent to the other computer. And only the computer that sent the lock has the key that can be used to decrypt and read it. So when you login to YWN, your web browser receives an encryption lock from the YWN server that it uses to turn your username and password to gibberish before sending it over. YWN then takes that gibberish and unlocks it to see the real password. This way, no one can intercept the message and read what it says. In technical terms, the lock is called a certificate.

Now, what some Kosher ISPs do is intercept the certificates exchanged between the two computers, and put their own their instead. The logic is fine, because they need to be able to see what your looking at, otherwise the shmira doesn’t work. But they can see everything because they literally have the keys to your kingdom.