4 ms·
Even with HTTPS enabled, institutions can censor based on IP or DNS. Blocking based on Deep-Packet-Inspection is a bit complex to set up for normal schools i th
by maze-le 12y ago
Even with HTTPS enabled, institutions can censor based on IP or DNS. Blocking based on Deep-Packet-Inspection is a bit complex to set up for normal schools i think.
- dezgeg 12y agoI'm pretty sure a DPI-based filtering can be purchased as an off-the-self service. And that's one of the core reasons I dislike HTTPS everywhere. It will lead to organizations like schools installing their own root certificates to MITM traffic, lessening the security of those things where encryption is the most important, like online banking.
- dublinben 12y agoMany universities already require the installation of a root certificate. The primary purpose is to avoid buying commercial certificates for every last internal university site, but it also has the effect you've mentioned.
- spacemanmatt 12y agoPlenty of vendors are ready to sell turnkey censorware to them. It's already a thing.
- superuser2 12y agoNope. Pretty much 100% of schools in the U.S. (with internet access) operate a transparent or explicit HTTP(s) proxy as the only way out to the internet from student-accessible vlans. Websense is probably the most popular commercial solution. My school district ran a Squid extension called Squidguard for a long time before switching to the filtering solution bundled with its new wireless controller system. Implementing web filtering is a condition of receiving federal subsidies; they take it seriously. A school with only a handful of PCs might use a host-based solution but proxy-as-the-only-way-out network design is very, very common.