Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4368

Re: Selective HTTPS blocking

Show all headers | View raw

On 2019-04-15, Grant Taylor <gtaylor@tnetconsulting.net> wrote:
> On 4/15/19 2:32 PM, Jorgen Grahn wrote:
>> I don't know a lot about TLS, but it seems to me it would be pretty 
>> worthless if it allowed someone in the middle to read and filter the URLs.
>
> Agreed.
>
> SSL / TLS makes it extremely difficult for someone not at either of the 
> SSL / TLS endpoints to know anything about the connection other than the 
> fact that it exists and what the (outer) URL hostname is.

But you said that you wanted to filter by the web page that was being
looked up at the host. So, just because the packets were going to that
host, it does not mean anything, since you have no idea which web page
is being looked up. And this also does nothing if the user uses a VPN to
get to that host and its web pages. 

>
> Remember, until Encrypted SNI becomes a thing, that it's possible to 
> tell what the certificate ≈ hostname being connected to is.
>
> I say "outer" above, because there's nothing that prevents connecting to 
> one certificate ≈ hostname and then using that server as a standard 
> HTTP(S) proxy server to connect to another hostname.  This is HTTPS 
> protected HTTP(S) proxy service, commonly called "Domain Fronting".
>
>> Isn't this kind of thing normally done by forcing everyone to go through 
>> a proxy (explaining first that their https sessions aren't secure 
>> after all)?
>
> Usually.
>
> It looks like it may be possible to use Proxy Auto Configuration to 
> filter on the path in the URL /if/ the client browser is complicit. 
> Read:  If someone doesn't mess with what enterprise IT configured the 
> browser to do.
>
>
>

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Selective HTTPS blocking Clark Smith <noaddress@nowhere.net> - 2019-04-15 15:21 +0000
  Re: Selective HTTPS blocking Dan Purgert <dan@djph.net> - 2019-04-15 15:26 +0000
    Re: Selective HTTPS blocking Jorgen Grahn <grahn+nntp@snipabacken.se> - 2019-04-15 20:32 +0000
      Re: Selective HTTPS blocking Grant Taylor <gtaylor@tnetconsulting.net> - 2019-04-15 14:55 -0600
        Re: Selective HTTPS blocking William Unruh <unruh@invalid.ca> - 2019-04-15 21:18 +0000
          Re: Selective HTTPS blocking Grant Taylor <gtaylor@tnetconsulting.net> - 2019-04-15 21:39 -0600
        Re: Selective HTTPS blocking Pascal Hambourg <pascal@plouf.fr.eu.org> - 2019-04-20 12:02 +0200
          Re: Selective HTTPS blocking Grant Taylor <gtaylor@tnetconsulting.net> - 2019-04-20 10:40 -0600
  Re: Selective HTTPS blocking Grant Taylor <gtaylor@tnetconsulting.net> - 2019-04-15 10:26 -0600
    Re: Selective HTTPS blocking Grant Taylor <gtaylor@tnetconsulting.net> - 2019-04-15 14:57 -0600
  Re: Selective HTTPS blocking andywhycare@gmail.com - 2019-05-02 02:48 -0700

csiph-web