5 ms·

What if some of your users will be behind a network level web-filter (like the one soon to be deployed in the UK)? If you run HTTPs your entire site will be blo

by jiggy2011 13y ago

What if some of your users will be behind a network level web-filter (like the one soon to be deployed in the UK)? If you run HTTPs your entire site will be blocked because 1 page fails the filter (because of a single swear word for example).

pushrax 13y ago
HTTPS means PG-13 in the UK's network filter?
- jiggy2011 13y ago
  With https the filter cannot mitm and figure out which page is being accessed, so will have to block the entire site.
  - BgSpnnrs 13y ago
    What filter are you discussing? AFAIK UK filtering is done by ISPs and conforms to their own solutions, there is no plan for a statewide filtering system.
    - jiggy2011 13y ago
      The filtering will be enabled by default for all large ISPs, so potentially a large % of the UK. You have the same problem with HTTPS either way.
  - revelation 13y ago
    I do not think thats how these filters operate. No banking/shopping site would properly function. They are just stupid IP based filters.
JoshTriplett 13y ago
Then HTTPS is doing its job by preventing an active MITM attack by a hostile third party. Option 1: negotiate with the filter maintainers to get your site whitelisted; that may require changing your content, but a site in which you have a commercial interest probably shouldn't have content on it that trips most filters (with some obvious exceptions on which the filter would be doing its job). Option 2: inform your users that they need to opt out of the filter in question, assuming they're in a situation/regime that allows doing so. Make it clear to them exactly which content is tripping the filter, and hope their reaction is "that's absurd". Option 3: maintain an insecure HTTP site for use from such locations, and arrange to redirect there or inform your users that they'll need to use that version due to the filter they're using.
Silhouette 13y ago
Nonsense. Blocking HTTPS traffic rules out far too many useful/essential things: e-commerce for home users, VPNs for business users away from the office, online banking and other financial services, any sort of government service that requires authentication. The list goes on and on, and the people most likely to defend secure browsing are going to be the likes of governments and financial institutions.

pushrax 13y ago

HTTPS means PG-13 in the UK's network filter?

jiggy2011 13y ago
With https the filter cannot mitm and figure out which page is being accessed, so will have to block the entire site.
- BgSpnnrs 13y ago
  What filter are you discussing? AFAIK UK filtering is done by ISPs and conforms to their own solutions, there is no plan for a statewide filtering system.
  - jiggy2011 13y ago
    The filtering will be enabled by default for all large ISPs, so potentially a large % of the UK. You have the same problem with HTTPS either way.
- revelation 13y ago
  I do not think thats how these filters operate. No banking/shopping site would properly function. They are just stupid IP based filters.

JoshTriplett 13y ago

Then HTTPS is doing its job by preventing an active MITM attack by a hostile third party. Option 1: negotiate with the filter maintainers to get your site whitelisted; that may require changing your content, but a site in which you have a commercial interest probably shouldn't have content on it that trips most filters (with some obvious exceptions on which the filter would be doing its job). Option 2: inform your users that they need to opt out of the filter in question, assuming they're in a situation/regime that allows doing so. Make it clear to them exactly which content is tripping the filter, and hope their reaction is "that's absurd". Option 3: maintain an insecure HTTP site for use from such locations, and arrange to redirect there or inform your users that they'll need to use that version due to the filter they're using.

Silhouette 13y ago

Nonsense. Blocking HTTPS traffic rules out far too many useful/essential things: e-commerce for home users, VPNs for business users away from the office, online banking and other financial services, any sort of government service that requires authentication. The list goes on and on, and the people most likely to defend secure browsing are going to be the likes of governments and financial institutions.