3 ms·

If the MITM CA is installed (maybe only via Group Policy) then browsers relax their requirements for CA's. But some domains (like google) are strictly locked do

If the MITM CA is installed (maybe only via Group Policy) then browsers relax their requirements for CA's. But some domains (like google) are strictly locked down to a specific set of CA's in Chrome. Since TLS Interception is critical for some places to achieve their duties (either auditing in banking, or content filtering in schools) we will always have some kind of legit use for MITM CA boxes. It gets slightly worse if you look at how AntiVirus generally installs CA's to do malware content filtering. Cloudflare publishes stats on what % of traffic they think has been MITM'd: https://malcolm.cloudflare.com/ https://malcolm.cloudflare.com/

miki123211 5y ago
Why are we okay with content filtering in schools? In Poland where I live, parental control basically doesn't exist. Children routinely watch movies, play games and visit websites that they're theoretically not supposed to visit. Parents know about it and don't really see an issue with it. I've seen several boarding school networks, none of them had any filtering whatsoever. The only filters I've seen were on computers in IT classrooms, but nobody uses those for non class-related activities anyway. As far as I know, we don't even have a law banning selling x-rated content to minors.
- ossusermivami 5y ago
  different countries different morales different way of educating childen, ymmv at the outcome!
easrng 5y ago
Content filtering is by no means critical and shouldn't be used at all. All it does is punish students who don't know how to use Tor. Every school I've been to besides my highschool had either no filter or a DNS or HTTPS based filter, and most students used VPN apps which are likely worse for them (spyware etc.) than not having filtering. My highschool used Fortinet which also did SNI blocking and tried to block Tor, requesting new bridges allowed me to connect. At least Fortinet quickly reclassifies false positives though.

miki123211 5y ago

Why are we okay with content filtering in schools? In Poland where I live, parental control basically doesn't exist. Children routinely watch movies, play games and visit websites that they're theoretically not supposed to visit. Parents know about it and don't really see an issue with it. I've seen several boarding school networks, none of them had any filtering whatsoever. The only filters I've seen were on computers in IT classrooms, but nobody uses those for non class-related activities anyway. As far as I know, we don't even have a law banning selling x-rated content to minors.

ossusermivami 5y ago
different countries different morales different way of educating childen, ymmv at the outcome!

easrng 5y ago

Content filtering is by no means critical and shouldn't be used at all. All it does is punish students who don't know how to use Tor. Every school I've been to besides my highschool had either no filter or a DNS or HTTPS based filter, and most students used VPN apps which are likely worse for them (spyware etc.) than not having filtering. My highschool used Fortinet which also did SNI blocking and tried to block Tor, requesting new bridges allowed me to connect. At least Fortinet quickly reclassifies false positives though.