20

Within our local education's I.T system, all websites served via HTTPS are blocked, except a select few websites which are 'authorized'.

This results in some websites being unable to function properly (such as Google's jQuery libraries, which are served via HTTPS).

I also remember reading an article a couple of years ago which said that HTTPS can cause problems with censor filters/proxies, as HTTPS connections cannot be intercepted & the page contents searched for blocked content (I haven't seen this behavior in many filters, but one such software that does this is censornet).

Disregarding educational use, I have also found that a few shared WiFi hotspots also engage in this behavior (of which are unfiltered for the most part). For example I was travelling via Gatwick Airport (U.K) last year & all HTTPS sites were blocked on the official 'Gatwick Airport WiFi' network.

Other than for filtering purposes, is there any reason to block HTTPS? HTTPS is paramount for websites that deal with private information (passwords, emails, etc), so I can't really see a good reason for blocking HTTPS.

Improve this question
3
  • 24
    Big brother is watching you!
    – MrWhite
    Oct 23, 2015 at 22:15
  • Was it L7 filtering? (Just curious)
    – Konrad Gajewski
    Oct 25, 2015 at 3:19
  • 1
    Fortunately, I can confirm that LGW no longer broad-block HTTPS on their Gatwick-branded free 45-minute Boingo hotspot. (I've been there five times since 1st September this year, and GMail and my own sites all functioned fine.)
    – Benjamin Nolan
    Oct 25, 2015 at 3:31

3 Answers 3

Reset to default
24

The most probable reasons for blocking encrypted communications (i.e. HTTPS), include:

  • Government & security related surveillance. It's easier for officials to intercept potential threats if they are in plain text. This is probably why the WiFi at the airport blocked HTTPS access.
  • Hacking / Man in the Middle Attacks. If your communications are not encrypted, plain text usernames and passwords can be intercepted by someone operating the hot spot. You often see these open WiFi hotspots in locations where the public is likely to login, like airports and coffee shops.

If they were simply filtering your traffic (blocking certain websites), the most direct way to do that is to simply block IP addresses or domain names. Blocking HTTPS most likely was used to ensure they could listen into your network traffic.

Improve this answer
1
  • There is a third option I've seen in the wild: plain incompetence resulting in a badly configured firewall, only allowing Port 80.
    – René Roth
    Jul 3, 2021 at 19:51
26

Simple: You can't easily filter/censor/virusscan/log the content if the connection is encrypted.

So there's three general ways to react:

  • install an SSL interception middle box that decrypts, scans, and re-encrypts SSL connections. This requires cooperation from each client PC. (By installing the middle box's CA certificate as trusted.)
  • block port 443
  • shrug and give up. Just scan HTTP connections and don't scan HTTPS connections.
Improve this answer
6
  • 1
    Option 1 is a Bad Idea (R)
    – bjb568
    Oct 24, 2015 at 16:02
  • Adding up: .../virusscan/injectvirus/...
    – Gustavo Rodrigues
    Oct 24, 2015 at 18:55
  • @bjb568 Why is it a bad idea? Could you explain or provide a link? I am curious about it because I have seen this practice on multiple organisations.
    – Utku
    Oct 24, 2015 at 22:03
  • 2
    @Utku Well, this requires trusting somebody who probably isn't trustworthy. See also superfish.
    – bjb568
    Oct 24, 2015 at 22:15
  • @bjb568 Oh I see. But for example, in the scenario of a company where the HTTPS connections of employees are intercepted by presenting a "home made" certificate, then there is no problem except the monitoring of the connections of employees by the relevant department?
    – Utku
    Oct 24, 2015 at 22:24
1

Going back a few years, HTTPS was most only used for logon pages.

By blocking HTTPS, and therefore logon pages, the education's I.T system has blocked access to on-line email systems and facebook etc. Access to most information sites would not be effected.

So it may have just been to control what the children did while at school.

Thinking about this more....

There may have been the feeling that by blocking HTTPS, web filters could be used better to stop access to porn etc.

As to public WiFi networks like Gatwick Airport, I expect it is just an error in how it is setup.

Improve this answer
4
  • 2
    Funnily enough Facebook is one of the authorized websites in the system.
    – AStopher
    Oct 24, 2015 at 11:39
  • While funny, I should say in high school we had a Facebook group with our year, used for school (sharing summaries, requesting copies of lost documents or occasionally homework, informing each other of cancelled classes, etc.). However, I wouldn't accept this as a reason for unblocking Facebook; I don't think you should block it in the first place, but in case it's blocked already, this wouldn't make me except it. Alternatives like Blackboard are generally much better suited.
    – 11684
    Oct 24, 2015 at 17:17
  • I doubt it was an error in setup. The default configuration for any router or firewall is to allow HTTPS. Someone would actually have to go in and change something to block it, and possibly install additional software. Seems like a lot of work just to accidentally remove the default functionality.
    – Scott M. Stolz
    Jan 13, 2016 at 15:37
  • My high school (somewhere in 2005) has blocked all HTTPS, and I guess it was for filtering. People used HTTPS proxy sites for a while. The filter was really horrible, so it blocked words like “Rechtsexperte” (German for “law expert”) as it contains “sex” and must be pornographic. At the time some free email provides had an option to let the login go over HTTP as a fallback.
    – Martin Ueding
    Mar 19, 2016 at 20:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .