Hacker News Reader

Comment by planetafro | Hacker News Reader

Wouldn't they need a cert/custom CA on your box to do that?

They need their custom CA on your box for your machine to accept the traffic by default, otherwise you'll get a big ugly untrusted cert error on every https/ssl connection, but some apps will let you ignore those (eg: curl --insecure)

I worked at a company that did this and it was a massive headache, every time I wanted to set up a new VM things would fail until I remembered I had to install their CA. I was an intern at the time, and they gave me some work that required an app that I couldn't configure to use their CA for the life of me. After a lot of failed troubleshooting I and ended up just running a SSH server on my home PC and creating a SOCKS proxy through that.

Yes. My university was using Fortigate back in the day and it had 3 behaviours

-Allow with no mitm (trusted sites)

-Block with no way around it(all residental IPs, pornsites)

-Allow but mitm the connection. The browser would present the classic ERR_UNKNOWN_ISSUER warning that most people would ignore. I couldn't figure out what criteria decided that a certain site needs the mitm treatment.

Ah yes, exactly the kind of intellectual freedom to explore and tinker you'd want to flourish at a university. Better block it! Wild guess: US?

Eh, if you care about privacy you shouldn't be browsing porn without a VPN or tunnel to a trusted server, "intellectual freedom" or not

In theory, if the tls connection wasn't tampered with, i.e the cert issuer is a party you trust, it shouldn't be a problem apart from the dns query.

I was referring to residential IPs.

Yep, by far that was the biggest PiA because I was hosting a lot of things at home.

>Wild guess: US?

Hungary.

My theory is that it was installed to curb filesharing and then it snowballed into generic blocking of various things on the university network.

>intellectual freedom to explore and tinker you'd want to flourish at a university.

Ah that sounds sweet. Reminds me of the anecdotes I read from the pioneer age of computing that people tell here sometimes. Well, the place I studied at was nothing like that. >_>

They could just block all tcp/443 traffic that they couldn't MITM, that's not uncommon in those kinds of setups.

Reply on news.ycombinator.com