3 ms·
Well, I may want to have a say in what websites the employees at work access in their browsers. For example.
by vman81 6mo ago
Well, I may want to have a say in what websites the employees at work access in their browsers. For example.
- altairprime 6mo agoThat’s not a meaningful issue here. Either snoop competently or snoop wire traffic, pick one. In the snooping-mandatory scenario, either you have a mandatory outbound PAC with SSL-terminating proxy that either refuses CONNECT traffic or only allows that which it can root CA mitm, or you have a self-signed root CA mitm’ing all encrypted connections it recognizes. The former will continue functioning just fine with no issues at providing that; the latter will likely already be having issues with certificate-pinned apps and operating system components, not to mention likely being completely unaware of 80/udp, and should be scheduled for replacement by a solution that’s actually effective during your next capital budgeting interval.
- kccqzy 6mo agoThat’s usually done not on the network side but through the device itself. Think MDM and endpoint management.
- ocdtrekkie 6mo agoA good solution is tackling it on both. At work we have network level firewalls with separate policies for internal and guest networks, and our managed PCs sync a filter policy as well (through primarily for when those devices are not on our network). The network level is more efficient, easier to manage and troubleshoot, and works on appliances, rogue hardware, and other things that happen not to have client management.
- ekr____ 6mo agoWell, if you have MDM you should be able to just disable ECH.
- ocdtrekkie 6mo agoThis is also indeed done on both. Browser policies.