Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Tim Watts Newsgroups: uk.d-i-y,uk.comp.os.linux,comp.os.linux.misc Subject: Re: Parental guardian - internet (WEB) filtering Date: Sat, 04 Apr 2015 21:37:54 +0100 Lines: 29 Message-ID: <2mu5vb-23b.ln1@squidward.dionic.net> References: <8ri4vb-ele.ln1@squidward.dionic.net> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit X-Trace: individual.net 9sPKkZ0+IsD6cPJcCwH+Kg+XiJ5r+UXTfaBW/QPNsF4WOft/g+ X-Orig-Path: squidward.dionic.net!not-for-mail Cancel-Lock: sha1:xszvOD+1eQpRJ/VDxN9FwFOCFBk= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 In-Reply-To: Xref: csiph.com comp.os.linux.misc:14336 On 04/04/15 21:28, Richard Kettlewell wrote: > Tim Watts writes: >> On 04/04/15 13:24, Martin Gregorie wrote: >>> I think its been dealt with by the Squid developers. See: >>> http://wiki.squid-cache.org/Features/HTTPS >>> >>> but working out exactly how an SSL connection is handled would need more >>> than the quick scan I gave it. Squid documentation seems to be a bit >>> fragmented and its website's internal search seems to be borked, but >>> hopefully that link will give you enough clues to find the relevant >>> entries. >> >> I can skip the read - because it is fundamentally impossible to proxy >> an SSL connection at anything above the TCP datastream as you'd need >> copies of the target SSL certs to be able to fake a session that was >> valid to the client. > > I think you’re confused about what a certificate is; they are public > data, and don’t in isolation let you fake anything. OK - bad terminology because I was being fast and loose - "key", then to be specific. > TLS MITM systems do exist; they require each client to trust a key held > by the MITM box. This is common on corporate networks and Lenovo > laptops.