21

Within our local education's I.T system, all websites served via HTTPS are blocked, except a select few websites which are 'authorized'.

This results in some websites being unable to function properly (such as Google's jQuery libraries, which are served via HTTPS).

I also remember reading an article a couple of years ago which said that HTTPS can cause problems with censor filters/proxies, as HTTPS connections cannot be intercepted & the page contents searched for blocked content (I haven't seen this behavior in many filters, but one such software that does this is censornet).

Disregarding educational use, I have also found that a few shared WiFi hotspots also engage in this behavior (of which are unfiltered for the most part). For example I was travelling via Gatwick Airport (U.K) last year & all HTTPS sites were blocked on the official 'Gatwick Airport WiFi' network.

Other than for filtering purposes, is there any reason to block HTTPS? HTTPS is paramount for websites that deal with private information (passwords, emails, etc), so I can't really see a good reason for blocking HTTPS.

  • 24
    Big brother is watching you! – MrWhite Oct 23 '15 at 22:15
  • Was it L7 filtering? (Just curious) – Konrad Gajewski Oct 25 '15 at 3:19
  • 1
    Fortunately, I can confirm that LGW no longer broad-block HTTPS on their Gatwick-branded free 45-minute Boingo hotspot. (I've been there five times since 1st September this year, and GMail and my own sites all functioned fine.) – Benjamin Nolan Oct 25 '15 at 3:31
23

The most probable reasons for blocking encrypted communications (i.e. HTTPS), include:

  • Government & security related surveillance. It's easier for officials to intercept potential threats if they are in plain text. This is probably why the WiFi at the airport blocked HTTPS access.
  • Hacking / Man in the Middle Attacks. If your communications are not encrypted, plain text usernames and passwords can be intercepted by someone operating the hot spot. You often see these open WiFi hotspots in locations where the public is likely to login, like airports and coffee shops.

If they were simply filtering your traffic (blocking certain websites), the most direct way to do that is to simply block IP addresses or domain names. Blocking HTTPS most likely was used to ensure they could listen into your network traffic.

26

Simple: You can't easily filter/censor/virusscan/log the content if the connection is encrypted.

So there's three general ways to react:

  • install an SSL interception middle box that decrypts, scans, and re-encrypts SSL connections. This requires cooperation from each client PC. (By installing the middle box's CA certificate as trusted.)
  • block port 443
  • shrug and give up. Just scan HTTP connections and don't scan HTTPS connections.
  • 1
    Option 1 is a Bad Idea (R) – bjb568 Oct 24 '15 at 16:02
  • Adding up: .../virusscan/injectvirus/... – Gustavo Rodrigues Oct 24 '15 at 18:55
  • @bjb568 Why is it a bad idea? Could you explain or provide a link? I am curious about it because I have seen this practice on multiple organisations. – Utku Oct 24 '15 at 22:03
  • 2
    @Utku Well, this requires trusting somebody who probably isn't trustworthy. See also superfish. – bjb568 Oct 24 '15 at 22:15
  • @bjb568 Oh I see. But for example, in the scenario of a company where the HTTPS connections of employees are intercepted by presenting a "home made" certificate, then there is no problem except the monitoring of the connections of employees by the relevant department? – Utku Oct 24 '15 at 22:24
1

Going back a few years, HTTPS was most only used for logon pages.

By blocking HTTPS, and therefore logon pages, the education's I.T system has blocked access to on-line email systems and facebook etc. Access to most information sites would not be effected.

So it may have just been to control what the children did while at school.

Thinking about this more....

There may have been the feeling that by blocking HTTPS, web filters could be used better to stop access to porn etc.

As to public WiFi networks like Gatwick Airport, I expect it is just an error in how it is setup.

  • 2
    Funnily enough Facebook is one of the authorized websites in the system. – AStopher Oct 24 '15 at 11:39
  • While funny, I should say in high school we had a Facebook group with our year, used for school (sharing summaries, requesting copies of lost documents or occasionally homework, informing each other of cancelled classes, etc.). However, I wouldn't accept this as a reason for unblocking Facebook; I don't think you should block it in the first place, but in case it's blocked already, this wouldn't make me except it. Alternatives like Blackboard are generally much better suited. – 11684 Oct 24 '15 at 17:17
  • I doubt it was an error in setup. The default configuration for any router or firewall is to allow HTTPS. Someone would actually have to go in and change something to block it, and possibly install additional software. Seems like a lot of work just to accidentally remove the default functionality. – Scott M. Stolz Jan 13 '16 at 15:37
  • My high school (somewhere in 2005) has blocked all HTTPS, and I guess it was for filtering. People used HTTPS proxy sites for a while. The filter was really horrible, so it blocked words like “Rechtsexperte” (German for “law expert”) as it contains “sex” and must be pornographic. At the time some free email provides had an option to let the login go over HTTP as a fallback. – Martin Ueding Mar 19 '16 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.