|
Thanks Amos for this clarification, We also have the same needs and indeed, we face with the same approach. It is possible that the structure of Squid could not, in some cases, recovering this type of information. Although the concept of a proxy is neither more nor less than a big browser that surfs instead of the client browsers. The SHA1 and certificate information reception are very valuable because it ensures better detection of compromised sites (many malicious sites use the same information in their certificates). This allows detecting "nests" of malicious sites automatically. Unfortunately, there is madness in the approach to security, there is a race to strengthen the security of tunnels (produced by Google and browsers vendors). What is the advantage of encrypting wikipedia and Youtube channels? On the other hand, it is crucial to look inside these streams to detect threats. This is antinomic... So TLS 1.3 and soon the use of QUIC with UDP 80/443 will make use of a proxy useless as these features are rolled out (trust Google to motivate them) Unless the proxy manages to follow this protocol madness race... For this reason, firewall manufacturers propose the use of client software that fills the gap of protocol visibility in their gateway products or you -can see a growth of workstation protections , such EDR concept Just an ideological and non-technical approach... Regards Le 19/11/2022 à 16:50, Amos Jeffries a
écrit :
On 19/11/2022 2:55 am, UnveilTech - Support wrote: |
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
