SWGfL filtering of SSL websites

[CliveMinion]

Can I ask what other schools' experiences and opinions of SWGfL's web filtering are, particularly in relation to the filtering of SSL encrypted websites?

 

Having installed the SWGfL Google SSL certificate, and enabled the corresponding proxy server, we've discovered that the filtering of Google searches works, as does the filtering of Wikipedia and a handful of other sites. However, this is only the case on a Windows PC. Installing the iOS version of the certificate on an iPad, and entering the same proxy details doesn't seem to have any effect. No amount of searched for inappropriate content seem to be blocked.

 

Has anyone else tried implementing the "Google SSL" certificate on an iPad, and if so, has it worked?

 

Even if this apparent problem could be resolved, it seems a very weak solution if only certain specified SSL websites are monitored. I'm wondering whether we need to put a third party filtering solution in place. Does anyone have any recommendations for this?

[Steve21]

Works fine here.

 

What one specifically are you trying proxy server wise?

 

Steve

[CliveMinion]

We are using sslfilter.proxy.swgfl.org.uk

[Steve21]

And you enabled full root trust for the cert? (Newly added after ios 10.something)

 

RM SafetyNet - SSL Filtering Certificate Test

 

Shows as passed?

 

Steve

[CliveMinion]

Yes we have, and the test shows as passed.

 

Can you confirm, if you open Google on an iPad and search for an inappropriate four letter word, you receive the SWGfL filter page? That doesn't happen for us, although it does on a Windows PC.

 

Thanks

[Steve21]

Yep blocks fine here.

 

Remember though, unless you've put a search rule in specifically yourself it doesn't block phrases it blocks websites/returned content. So if for example you're searching for pron, and all the images that are deemed "bad" are filtered out, it wouldn't stop it bringing back I'll use the word "legit" with caution, but "legit" websites etc (wiki for example)

 

Steve

[CliveMinion]

Regardless of the contents of our search rules, would you not expect to see the same results on all devices? It doesn't seem right that a search for pornographic material (for example) is blocked on a Windows PC, but not on an iPad.

[Steve21]

No because it's not using the same browser or rules.

 

For example, Safari in mobile mode doesn't bring back any images as part of a google search. So if they're what's flagging to be blocked on your computer it's different to what's showing on the ipad etc.

 

While a specific website http://www.lotsofpron.com should be filtered on both, a search result with different items returned and details sent as part of it's search URL would expect it different.

 

Does the ipad search you're doing actually bring back anything that would be deemed blocked? Whether or not the entire page is showing as blocked on pc.

 

Steve

[CliveMinion]

Here's some specific examples:

 

I've created a search rule to deny the words "porn" and "sex". If I do a google search for "porn" on a Windows PC, I immediately received a message to say this search is blocked by restriction list. The same search on an iPad brings up a whole load of articles relating to pornography.

 

Wikipedia is another example of an SSL site. On a PC, if I search Wikipedia for "sex", I get redirected to the SWGfL filter page. On an iPad, the search isn't blocked.

 

Similar tests involving non-SSL encrypted sites result in identical behaviour between the two platforms.

[Steve21]

Both seem to work the same for me. If I've added a search block rule *sex* etc I get the same results back.

 

If you browser to RM Education - Proxy Test on both ones does it show they're using the same filters? Just wondering if it's something silly on like a WPAD overruling your proxy settings

 

Steve

[CliveMinion]

One desktop PC and two iOS devices are showing three different proxy servers according to that test. Both iOS devices behave the same as each other though.

WPAD isn't involved here.

Thanks for checking this for me. I don't believe SWGfL support have contacted other schools to see if they have the same fault, so this is helpful to know.