Blocking websites without SSL inspection - Which Filtering Vendors can do this?

[mavhc]

then they just enable DoH, TLS 1.3 and eSNI and you can now only filter based on the ip they're connecting to, which is probably just AWS.

[free780]

then they just enable DoH, TLS 1.3 and eSNI and you can now only filter based on the ip they're connecting to, which is probably just AWS.

I wonder how if the smoothwall browser extension gets round this? As always BYOD will be a pain as you'll have to require a browser extension which won't work on phones/tablets. Or do you not have BYOD and have 1:1 devices which will cost a lot.

[Arthur]

I wonder how if the smoothwall browser extension gets round this?

The webRequest API* (the same API that adblocking extensions currently use).

 

https://crxcavator.io/report/jbldkhfglmgeihlcaeliadhipokhocnm/1.0.15131

 

* At least for Chrome/Chromium browsers.

[altecsole]

I had a webinar with SonicWall last week and, if I remember correctly, you can turn on a kind of 'SSL Lite' option that just inspects the certificate for a site, rather than doing full SSL inspection.

[chaplic]

The answer to your question is 'no'. The filter cannot show a block page without the issue mentioned

 

Think about it - user calls https://www.youtube.com which you have blocked. The web browser is expected to received content from a website with the valid cert for http://www.youtube.com. Instead it receives a website with a cert signed by your proxy.

 

It's the same reason if you use guest wifi with a login portal but your first visit is to an https page you'll get a similar issue. Even if your proxy issued a redirect from https to http, that redirect would still trigger the warning (otherwise man-in-the-middle attacks for https would be trivial)

 

If the product supports it, I suppose simply dropping the connection is doable and won't trigger the issue but I'd think the current experience is better.

[chris11256]

As others have said, without SSL Decryption of some kind the users will just get an error. So in our case all domain devices get a Palo Alto block page, as all that traffic is decrypted. However BYOD stuff isn't, so sites are still blocked but they get an error rather than a block page.

[mavhc]

Might be possible to write an extension that did it, wait for the error, check via an api to the filtering site why it was blocked, and then show an error page. But at that point might as well just have the extension do the filtering.

[ibpalle]

Smoothwall is offering just that at the moment - extensions for filtering instead of going through a proxy. Only supported for Chromebooks at the moment but other browsers and OS are in the works.

 

It has it's caveats as everything does but the extension providing the filtering means HTTPS decrypt is no longer needed as the extension reads the page content coming out of the browser, not sitting between the browser and the internet as the proxy does. Interesting to see the takeup on that.