The question is exactly what the title says. I am a student attending a rather large high school in South Carolina. In order to block to youtube, proxies, games, etc., the school has disabled SSL and TLS (secure socket protocol for web security). These are standards for all web browsers (I get a warning on my MAC that there may be an attack on my computer if I even get on their wifi and open Safari), and what is even more scary (and angering) to me is that they have a fake google certificate which they do not inform people of in any way or agreement. I understand that I am a minor and am resigned that I can do nothing about it, but this must illegal. I cannot imagine what the consequences would be if I did the on a private server. The vulnerability is further irresponsible because it leaves people's private data being transferred over the school network (such as private e-mail, logins) unsecured and open to packet sniffing.

  • When you say "my computer" do you mean your own privately-owned computer that you are allowed to connect to the school's network, or do you mean a school-owned computer which you have been allowed to use?
    – apsillers
    Sep 29 '16 at 16:02

This is more than a comment (too long), but not a definitive answer (since I am unfamiliar with the laws regarding this kind of thing). Please forgive me.

First, there are some technical misunderstandings. They are not disabling SSL/TLS. Instead, they are inserting themselves in between these connections so they can make sure you aren't accessing material you are not allowed to access. They may actually be required to do this by law.

Here is how it works. Typically when you connect to, say Google.com, you are given a certificate from Google.com that has a trusted chain all the way up to some trusted root. That trusted root is explicitly trusted by your web browser manufacturer. In order to be able to inspect these sorts of connections, security appliances will actually replace the certificate provided by Google.com with one that the appliance provides. It has to pretend to be Google.com so your browser doesn't freak out. The problem is, this certificate is no longer has a trusted chain to something that the browser manufacturer trusts. It is provided by the security appliance. So often, the appliance will have a root certificate that the administrators of the system must install on every machine they control. Then the browsers on these machines will not complain that the certificate is invalid.

Obviously, you are getting the error on your own machine because you have not allowed the administrator to install these certificates on your machine. Nor should you. You should definitely not allow your school's network administrator to install these certificates on your personal computer.

You say that "leaves people's private data being transferred over the school network (such as private e-mail, logins) unsecured and open to packet sniffing". This is not true. Any HTTPS website you visit is encrypted between your computer and the security monitoring appliance using the pretend certificate I mentioned above. Typically then, the traffic is decrypted and inspected by the appliance. Then it is re-encrypted using the real certificate, before being pushed out onto the internet. So, only at the security appliance is data turned back into the clear, only to be protected again before going out to the internet.

So, is this illegal?

Well, I think you would agree that definitely on the computers that your school owns, they can do anything they want with them. The computers belong to them. Furthermore, the network belongs to them. Likely you signed an agreement (or agree to it each time you connect) that they are allowed to monitor your usage of their computers and their network. This includes when connecting your personal machine to their network.

  • 2
    Although technically your point about "leaves people's private data being transferred over the school network (such as private e-mail, logins) unsecured and open to packet sniffing" is true, expecting the school to have the kind of security knowledge, procedures and audits that google does it probably unwise, so yes by doing this the school is making data much less safe.
    – Sam
    Sep 30 '16 at 17:17
  • @Sam, agreed, completely.
    – mikeazo
    Sep 30 '16 at 17:23
  • Yeah, it blocks most VPNs too so there is pretty much no way around it. Honestly, I don't think it's an enormous problem outside of principle. We should at least be aware that our data isn't secured. And as for not expecting the school to know that, I'm 16 and I know it so why shouldn't the IT department? Oct 1 '16 at 21:51
  • 1
    They are probably trying to balance security with obligations to keep students off of sites they shouldn't be on. I can imagine lawsuits if a parent found out their child was surfing porn or buying drugs online at school. PS, be careful trying to use VPN. I know a high school kid here who was suspended for that. It is likely against some agreement you signed.
    – mikeazo
    Oct 1 '16 at 22:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.