6 ms·

I think schools banning HTTPS has a lot more to do with being able to censor what the students are visiting than saving bandwidth.

maze-le 12y ago
Even with HTTPS enabled, institutions can censor based on IP or DNS. Blocking based on Deep-Packet-Inspection is a bit complex to set up for normal schools i think.
- dezgeg 12y ago
  I'm pretty sure a DPI-based filtering can be purchased as an off-the-self service. And that's one of the core reasons I dislike HTTPS everywhere. It will lead to organizations like schools installing their own root certificates to MITM traffic, lessening the security of those things where encryption is the most important, like online banking.
  - dublinben 12y ago
    Many universities already require the installation of a root certificate. The primary purpose is to avoid buying commercial certificates for every last internal university site, but it also has the effect you've mentioned.
- spacemanmatt 12y ago
  Plenty of vendors are ready to sell turnkey censorware to them. It's already a thing.
- superuser2 12y ago
  Nope. Pretty much 100% of schools in the U.S. (with internet access) operate a transparent or explicit HTTP(s) proxy as the only way out to the internet from student-accessible vlans. Websense is probably the most popular commercial solution. My school district ran a Squid extension called Squidguard for a long time before switching to the filtering solution bundled with its new wireless controller system. Implementing web filtering is a condition of receiving federal subsidies; they take it seriously. A school with only a handful of PCs might use a host-based solution but proxy-as-the-only-way-out network design is very, very common.
josephkern 12y ago
They can't buy and configure an HTTPS proxy? Those things do exist after all.
- Someone1234 12y ago
  HTTPS proxies work less well today than they did even five years ago. Certificate pinning and other security improvements have broken a lot of things (by design). So the question is: What is more important, allowing HTTPS proxies, or stopping governments with a CA from MitM-ing traffic (e.g. Iran, China, etc). A nice compromise might be to inform users that they're being MitM-ed by an installed CA, but only once and subtly so.
  - MichaelGG 12y ago
    Which browsers enforce pinning when faced with a CA proxy? Chrome explicitly overrides pinning in this case, so they don't break half of all corporate usage.
dheera 12y ago
Maybe schools should just stop censoring students? We should setting examples for children, and set the example of mutual trust and responsibility, not "how to spy on other people below you".
- Someone1234 12y ago
  That would require legal changes. At the moment many schools are legally required to censor students. This is also in a country which still doesn't teach comprehensive sex ed' in many places and for which many adults don't want kids to have access to that information.

maze-le 12y ago

Even with HTTPS enabled, institutions can censor based on IP or DNS. Blocking based on Deep-Packet-Inspection is a bit complex to set up for normal schools i think.

dezgeg 12y ago
I'm pretty sure a DPI-based filtering can be purchased as an off-the-self service. And that's one of the core reasons I dislike HTTPS everywhere. It will lead to organizations like schools installing their own root certificates to MITM traffic, lessening the security of those things where encryption is the most important, like online banking.
- dublinben 12y ago
  Many universities already require the installation of a root certificate. The primary purpose is to avoid buying commercial certificates for every last internal university site, but it also has the effect you've mentioned.
spacemanmatt 12y ago
Plenty of vendors are ready to sell turnkey censorware to them. It's already a thing.
superuser2 12y ago
Nope. Pretty much 100% of schools in the U.S. (with internet access) operate a transparent or explicit HTTP(s) proxy as the only way out to the internet from student-accessible vlans. Websense is probably the most popular commercial solution. My school district ran a Squid extension called Squidguard for a long time before switching to the filtering solution bundled with its new wireless controller system. Implementing web filtering is a condition of receiving federal subsidies; they take it seriously. A school with only a handful of PCs might use a host-based solution but proxy-as-the-only-way-out network design is very, very common.

josephkern 12y ago

They can't buy and configure an HTTPS proxy? Those things do exist after all.

Someone1234 12y ago
HTTPS proxies work less well today than they did even five years ago. Certificate pinning and other security improvements have broken a lot of things (by design). So the question is: What is more important, allowing HTTPS proxies, or stopping governments with a CA from MitM-ing traffic (e.g. Iran, China, etc). A nice compromise might be to inform users that they're being MitM-ed by an installed CA, but only once and subtly so.
- MichaelGG 12y ago
  Which browsers enforce pinning when faced with a CA proxy? Chrome explicitly overrides pinning in this case, so they don't break half of all corporate usage.

dheera 12y ago

Maybe schools should just stop censoring students? We should setting examples for children, and set the example of mutual trust and responsibility, not "how to spy on other people below you".

Someone1234 12y ago
That would require legal changes. At the moment many schools are legally required to censor students. This is also in a country which still doesn't teach comprehensive sex ed' in many places and for which many adults don't want kids to have access to that information.