4 ms·

Should elementary aged school children have privacy while surfing the internet from school? If the answer to that question is "no" then the answer about HTTPS e

Should elementary aged school children have privacy while surfing the internet from school? If the answer to that question is "no" then the answer about HTTPS everywhere can be seen as knee-jerk. Of course, system administrators could put further work into making sure that computers are not used maliciously, for example, by recording the screen constantly and by randomly inspecting the recording or by using machine learning to identify things like pornography, but it won't cover everything (browser bars that are actually malware or other viruses) and it's a whole lot easier to just thwart HTTPS than it is to do anything else.

fulafel 10y ago
Yes, of course children should have privacy.
joncp 10y ago
Don't forget that HTTPS everywhere is not just about privacy.
__jal 10y ago
Your argument is that privacy and security stances for web browsing should be driven by what is appropriate for the 10-and-under crowd?
jcrawfordor 10y ago
The situation you describe is a great use case for well-implemented TLS interception. There is absolutely no need to degrade security and privacy for everyone else just to cover this case of individuals in a more restrictive environment.
- 3pt14159 10y ago
  The question was "why not HTTPS everywhere?" which I've answered. Your rebuttal is "then don't use HTTPS everywhere!" then ok, we're in agreement. Your answer could have also been "doesn't matter, still use HTTPS everywhere!" which I think is also a fine answer if we're also ok with taking certain computers off of the internet, like say the computers that children use at school[1] or computers in charge of medical data, but our choice is one of three things: 1. Give up privacy because our data is easy to leak out through HTTPS traffic, so we'll admit defeat and let our healthcare records leak because we can't MITM the traffic. 2. Give up privacy because we have methods of MITM attacking, including for both good and evil uses. 3. Give up efficiency by removing computers from the internet / other large networks. Personally I think the long run is #3 but I've underestimated humanity's laziness many times. [1] I'm actually 100% ok with this until a certain age, they really don't need more than messaging, typing classes, a math program or three, and Wikipedia.
  - jcrawfordor 10y ago
    TLS interception does not equate to not using HTTPS. Loading a trusted MITM certificate into the trust stores of computers an organization manages is a perfectly valid way to use HTTPS that does not need to compromise the security of HTTPS, even if many products have implemented it poorly.
nsgi 10y ago
Yes, they should. They might want to look up information on abuse, sexual health or homosexuality in confidence. There are other ways to accomplish preventing children from accessing inappropriate content, namely filtering by domain which is still possible with HTTPS. Google SafeSearch can also be turned on at the DNS level, still allowing HTTPS to be used and privacy to be maintained. The best way to accomplish more granular filtering is to install a custom browser extension that monitors what pages are visited, no machine learning necessary. And if group policy doesn't prevent browser toolbars from being installed, the school has bigger problems.
- 3pt14159 10y ago
  You're simultaneously saying that children should have privacy while also saying children should have browser extensions that monitors what pages are being visited.
scrollaway 10y ago
> Should elementary aged school children have privacy while surfing the internet from school? Yes... yes they should. What would possess someone to say they shouldn't? If this is about parental controls, it's a non-issue, as someone else explained. You can have both privacy and parental controls.
solatic 10y ago
> to identify things like pornography You do understand that: a) nobody has come up with an algorithm that can visually identify pornography? Hell, how can we come up with an algorithm when we have such trouble even legally defining pornography? https://en.wikipedia.org/wiki/I_know_it_when_I_see_it https://en.wikipedia.org/wiki/I_know_it_when_I_see_it b) TLS doesn't mask the source/destination IP's, just the content, and as such pornographic sites can still be filtered and banned in school environments without attacking TLS. ... right?
- 3pt14159 10y ago
  Of course I realize that TLS doesn't mask that. It doesn't matter though because https://reddit.com/r/nsfw https://reddit.com/r/nsfw or https://imgur.com/hotaction.jpg https://imgur.com/hotaction.jpg are both shrouded by HTTPS. Also, plenty of people have come up with algorithms that are very reliable (highly performant ROC curves) at identifying pornography. Certainly reliable enough for whatever pornography today's children are searching for on school computers.

fulafel 10y ago

Yes, of course children should have privacy.

joncp 10y ago

Don't forget that HTTPS everywhere is not just about privacy.

__jal 10y ago

Your argument is that privacy and security stances for web browsing should be driven by what is appropriate for the 10-and-under crowd?

jcrawfordor 10y ago

The situation you describe is a great use case for well-implemented TLS interception. There is absolutely no need to degrade security and privacy for everyone else just to cover this case of individuals in a more restrictive environment.

3pt14159 10y ago
The question was "why not HTTPS everywhere?" which I've answered. Your rebuttal is "then don't use HTTPS everywhere!" then ok, we're in agreement. Your answer could have also been "doesn't matter, still use HTTPS everywhere!" which I think is also a fine answer if we're also ok with taking certain computers off of the internet, like say the computers that children use at school[1] or computers in charge of medical data, but our choice is one of three things: 1. Give up privacy because our data is easy to leak out through HTTPS traffic, so we'll admit defeat and let our healthcare records leak because we can't MITM the traffic. 2. Give up privacy because we have methods of MITM attacking, including for both good and evil uses. 3. Give up efficiency by removing computers from the internet / other large networks. Personally I think the long run is #3 but I've underestimated humanity's laziness many times. [1] I'm actually 100% ok with this until a certain age, they really don't need more than messaging, typing classes, a math program or three, and Wikipedia.
- jcrawfordor 10y ago
  TLS interception does not equate to not using HTTPS. Loading a trusted MITM certificate into the trust stores of computers an organization manages is a perfectly valid way to use HTTPS that does not need to compromise the security of HTTPS, even if many products have implemented it poorly.

nsgi 10y ago

Yes, they should. They might want to look up information on abuse, sexual health or homosexuality in confidence. There are other ways to accomplish preventing children from accessing inappropriate content, namely filtering by domain which is still possible with HTTPS. Google SafeSearch can also be turned on at the DNS level, still allowing HTTPS to be used and privacy to be maintained. The best way to accomplish more granular filtering is to install a custom browser extension that monitors what pages are visited, no machine learning necessary. And if group policy doesn't prevent browser toolbars from being installed, the school has bigger problems.

3pt14159 10y ago
You're simultaneously saying that children should have privacy while also saying children should have browser extensions that monitors what pages are being visited.

scrollaway 10y ago

> Should elementary aged school children have privacy while surfing the internet from school? Yes... yes they should. What would possess someone to say they shouldn't? If this is about parental controls, it's a non-issue, as someone else explained. You can have both privacy and parental controls.

solatic 10y ago

> to identify things like pornography You do understand that: a) nobody has come up with an algorithm that can visually identify pornography? Hell, how can we come up with an algorithm when we have such trouble even legally defining pornography? https://en.wikipedia.org/wiki/I_know_it_when_I_see_it https://en.wikipedia.org/wiki/I_know_it_when_I_see_it b) TLS doesn't mask the source/destination IP's, just the content, and as such pornographic sites can still be filtered and banned in school environments without attacking TLS. ... right?

3pt14159 10y ago
Of course I realize that TLS doesn't mask that. It doesn't matter though because https://reddit.com/r/nsfw https://reddit.com/r/nsfw or https://imgur.com/hotaction.jpg https://imgur.com/hotaction.jpg are both shrouded by HTTPS. Also, plenty of people have come up with algorithms that are very reliable (highly performant ROC curves) at identifying pornography. Certainly reliable enough for whatever pornography today's children are searching for on school computers.