5 ms·

Wouldn't they need a cert/custom CA on your box to do that?

SahAssar 5y ago
They could just block all tcp/443 traffic that they couldn't MITM, that's not uncommon in those kinds of setups.
agolliver 5y ago
They need their custom CA on your box for your machine to accept the traffic by default, otherwise you'll get a big ugly untrusted cert error on every https/ssl connection, but some apps will let you ignore those (eg: curl --insecure) I worked at a company that did this and it was a massive headache, every time I wanted to set up a new VM things would fail until I remembered I had to install their CA. I was an intern at the time, and they gave me some work that required an app that I couldn't configure to use their CA for the life of me. After a lot of failed troubleshooting I and ended up just running a SSH server on my home PC and creating a SOCKS proxy through that.
no_time 5y ago
Yes. My university was using Fortigate back in the day and it had 3 behaviours -Allow with no mitm (trusted sites) -Block with no way around it(all residental IPs, pornsites) -Allow but mitm the connection. The browser would present the classic ERR_UNKNOWN_ISSUER warning that most people would ignore. I couldn't figure out what criteria decided that a certain site needs the mitm treatment.
- gspr 5y ago
  Ah yes, exactly the kind of intellectual freedom to explore and tinker you'd want to flourish at a university. Better block it! Wild guess: US?
  - xvector 5y ago
    Eh, if you care about privacy you shouldn't be browsing porn without a VPN or tunnel to a trusted server, "intellectual freedom" or not
    - no_time 5y ago
      In theory, if the tls connection wasn't tampered with, i.e the cert issuer is a party you trust, it shouldn't be a problem apart from the dns query.
    - gspr 5y ago
      I was referring to residential IPs.
      - no_time 5y ago
        Yep, by far that was the biggest PiA because I was hosting a lot of things at home.
  - no_time 5y ago
    >Wild guess: US? Hungary. My theory is that it was installed to curb filesharing and then it snowballed into generic blocking of various things on the university network. >intellectual freedom to explore and tinker you'd want to flourish at a university. Ah that sounds sweet. Reminds me of the anecdotes I read from the pioneer age of computing that people tell here sometimes. Well, the place I studied at was nothing like that. >_>

They could just block all tcp/443 traffic that they couldn't MITM, that's not uncommon in those kinds of setups.

They need their custom CA on your box for your machine to accept the traffic by default, otherwise you'll get a big ugly untrusted cert error on every https/ssl connection, but some apps will let you ignore those (eg: curl --insecure) I worked at a company that did this and it was a massive headache, every time I wanted to set up a new VM things would fail until I remembered I had to install their CA. I was an intern at the time, and they gave me some work that required an app that I couldn't configure to use their CA for the life of me. After a lot of failed troubleshooting I and ended up just running a SSH server on my home PC and creating a SOCKS proxy through that.

no_time 5y ago

Yes. My university was using Fortigate back in the day and it had 3 behaviours -Allow with no mitm (trusted sites) -Block with no way around it(all residental IPs, pornsites) -Allow but mitm the connection. The browser would present the classic ERR_UNKNOWN_ISSUER warning that most people would ignore. I couldn't figure out what criteria decided that a certain site needs the mitm treatment.

gspr 5y ago
Ah yes, exactly the kind of intellectual freedom to explore and tinker you'd want to flourish at a university. Better block it! Wild guess: US?
- xvector 5y ago
  Eh, if you care about privacy you shouldn't be browsing porn without a VPN or tunnel to a trusted server, "intellectual freedom" or not
  - no_time 5y ago
    In theory, if the tls connection wasn't tampered with, i.e the cert issuer is a party you trust, it shouldn't be a problem apart from the dns query.
  - gspr 5y ago
    I was referring to residential IPs.
    - no_time 5y ago
      Yep, by far that was the biggest PiA because I was hosting a lot of things at home.
- no_time 5y ago
  >Wild guess: US? Hungary. My theory is that it was installed to curb filesharing and then it snowballed into generic blocking of various things on the university network. >intellectual freedom to explore and tinker you'd want to flourish at a university. Ah that sounds sweet. Reminds me of the anecdotes I read from the pioneer age of computing that people tell here sometimes. Well, the place I studied at was nothing like that. >_>