Slashdot Mirror
Schools, Filtering Companies Blocking Google SSL
An anonymous reader in the UK writes "Over the past several weeks we've discussed the rolling out of Google SSL search. Now an obstacle to the rollout has arisen, much to the frustration of school students and teachers alike. Content filter vendors have decided to block all Google SSL traffic — which also blocks access to Google Apps for Education. Google is working to appease these vendors. The questions at the heart of this situation are: Does a company (school, government) have a right to restrict SSL traffic so it can snoop your data, or does an individual have a right to encrypted Internet facilities? And, is the search data you create your data, or is it your employer's (school's)? IANAL but blocking SSL search seems at odds with the UK Data Protection Act, because some local governments here may be using the very same filtering service for their employees. It would also seem to go against the spirit of FIPS in the US (though I appreciate that federal standards are separate from schools in the States)."
I hate to tell these schools how to turn into a police state, but if they really want to monitor Google SSL traffic, this is the right way to do it:
1. Install a trusted root certificate in all client browsers (they do control their client computers, right?)
2. Man in the middle all SSL traffic through a transparent proxy, which masquerades as Google SSL traffic and redirects from https://www.google.com/ to http://www.google.com./
Don't just block all SSL traffic. If you truly have a legitimate reason to monitor users search queries and application traffic, then you already control their client PCs (right?) and can do this in a semi-legitimate way. If not, don't bother blocking it because your users will be up in arms with pitchforks and torches.
"When the president does it, that means it's not illegal." - Richard M. Nixon
I graduated from highschool in 2008; every few months the county would roll out a new filtering system designed to block myspace/facebook/sourceforge/other questionable stuff. It would take the tech students about 15 minutes to figure out either a new workaround or modify an old one to get around the new filter. This would then filter down to the technologically illiterate kids in a about a month, prompting the release of a new blocking system. Repeat process. The end use of this was we wound up running an apache server off a flash drive on one machine which everyone would ssh to locally using firefox's proxy settings and that "server" would connect to a home server which acted as the gateway. Kids will find a way around it, so I doubt it will work for long in schools.
Orwell was an optimist.
As a sysadmin for a school district, I don't give a flying fsck about "someone's data". My job is to implement our filtering policy. As we can't tell if SSL-encrypted search pages contain banned content, we block them.
This whole article is just the rantings of an idiot who thinks they know more than they do.
And that doesn't mean you were allowed to do it, though.
If you don't like it, DON'T AGREE TO IT! Don't be all stupid anonymous (yes, the irony is thick,) about it. Flat out refuse to sign it. Tell them that they changed the contract on you, and you demand a refund, or you demand that they not enforce the agreement on you. It's that simple.
People who cry "FREEDOM!" from anonymous forums, while using the mantle of freedom as an excuse to do illegal things are just whiny spoiled brats. If you actually want to make a real statement, make it. Don't agree to stuff you dislike, then anonymously break it. That's just stupidity and arrogance. (And, yes, I know of which I speak; I have been fired from a job for making public information that WAS public, but which the company declared after the fact should not have been; combined with PUBLICLY standing up to the leadership of the company for their inanity and impropriety.)
Another non-functioning site was "uncertainty.microsoft.com."
The purpose of that site was not known.
The company that I work for has a proxy that filters and caches HTTP, FTP, and HTTPS. The proxy basically does something of a man-in-the-middle attack. When you request an HTTPS website, the proxy establishes a secure connection with the remote site, fetches the data, decrypts it, re-encrypts it with the company's SSL certificate (which is installed by default on all workstations), and sends it to the user's browser.
The most annoying thing is that when this happens, the user has no idea that their traffic is being intercepted, cached, and possibly modified unless they happen to check the certificate and see that the organization is the name of the company they work for rather than, say, Google. But of course even that is easy to spoof when the company has its certificate authority preinstalled on all of the desktops.
Expect this to become more common. Regular users can't spot it because they have been trained to look for the padlock icon and the "https" to determine whether or not a site is "secure." It won't be long until every company does this as automatically as they install firewalls or spam-filtering products. Schools and libraries will have to use it so that they can block inappropriate content coming in via HTTPS. I fully expect that some major national ISPs are already looking into what it would take to force this upon their customer base at some point. I'm afraid hijacking DNS was only the first step, folks.
My kingdom for mod points. This is exactly true and is the single biggest vulnerability of SSL.
Every web browser trusts hundreds of root certificates. Most of them are entities that I've never heard of or wouldn't necessarily *want* to trust anyway. (HongKong Post, anyone?) Any of these CAs can effortlessly forge an SSL certificate for any site on the web. I would find it extremely hard to believe that not a single one of them is secretly cooperating with government agencies, law enforcement, or anyone with a large enough check book.
I would find it extremely hard to believe that not a single one of them is secretly cooperating with government agencies, law enforcement, or anyone with a large enough check book.
To prove that you just need to provide a single example of a fake certificate used by a government. Which no-one has so far; the only examples I know of were stupid CAs who'd sign any old crap rather than crooked CAs.
The simple fix, as others have pointed out before, is that any web browser should warn the user if the site certificate changes. Then you're at least safe at any site you've visited before.
Full disclosure: I am involved with Opendium who produce web content filtering software for schools.
OK, so what about the student with the 3G iPad?
Sure, you can't prevent pupils from accessing questionable content on their own internet connections. But that isn't such a big problem.
Kids need *an* internet connection for their education - the school provides this and implements filters to ensure that this internet connection is "safe" (we'll come onto "safe" later). If pupils have their own equipment then the school need to police it's use manually; but they can be much more draconian with the way they handle it - if a pupil is caught surfing porn on their 3G iPad then the school can just plain confiscate it and inform the parents. The pupil does not *need* that equipment for their education - if they abuse the privilege of having their own equipment then they forfeit it and have use the school's equipment instead.
Also, importantly from a PR perspective, if this is happening on the pupil's own equipment and connection then it won't be seen as the school's fault (it is more like the kid going to the corner shop and buying Playboy - hardly something the school can prevent, although they would probably confiscate the magazine if they saw it); whereas if kids are actively surfing porn on the school's equipment/connection then the school is seen by many to be failing in their duty of care. Silly, I know, but I have seen schools getting some seriously bad PR from the tabloids because little Johnny got at dodgy websites through the school's computers - remember that news papers don't care about news these days, they are more interested in a sensationalist story with a definite villain in it.
As for what is "safe", filtering is basically about 3 things:
Different schools have different attitudes to how strict they want to be. Something my customers often find very useful to help deal with distractions is the ability to set certain websites, such as facebook, games, etc. to be off-limits during lesson times but allowed during breaks - this seems like a very fair balance to me. Another thing quite common amongst my customers is to use more relaxed controls for older kids since there are websites the older kids may legitimately want to see (e.g. sexual health sites, etc.) that you wouldn't want the younger kids to stumble across.
Something that I've noticed amongst people commenting on these subjects on the internet is that they frequently fall into one of two camps:
To address (1) first - I am usually the last person to promote censorship, but I do believe that schools have a responsibility to protect kids from the content on the internet. Most parents seem to agree. If you, as a parent, disagree with this then you are free to let your child have free reign on the internet from home; just don't expect this to happen on school equipment. As someone involved in writing filtering software, I certainly don't see myself as "evil" - I don't set policies on what gets filtered, I simply provide the tools to allow those in charge to do what they believe is the responsible thing. Note that I am only saying that censorship
http://blog.nexusuk.org