Hacker News Reader

Comment by stanleydrew | Hacker News Reader

It does seem pretty weird that Google would make a change like this that effects everyone just to appease some schools that can't figure out how to properly configure their firewalls.

View on HN

They did it because it was the easiest way for google to make it easy to filter out encrypted search without breaking their other services. A very simple change for google -vs- a very difficult firewall configuration for a network administrator. (You can't just block https://www.google.com/ without breaking a whole bunch of other services you may want to be using) (and you probably don't have the budget & manpower to deploy the type of network you would need to scan & filter HTTPS traffic as an organization if you are a school, either)

How exactly would you scan and filter https? It's encrypted.

It's trivial (but evil) for an organization like a school to set up a proxy for https, since they are in a position to install the necessary root certificates in browsers (classic MITM attack). Devices are already on the market to make this easy to deploy (shudder).

Meet the new CISCO MITM 5505, trust CISCO for all your net appliance needs.

Maybe the schools should filter the content instead of the searches.

And how exactly should they configure their firewalls?

It's not possible to do that. The firewall has no idea what's being communicated because it's encrypted!

Reply on news.ycombinator.com