internet education cryptography
Is it legal to create a fake google certificate and distribute it en masse?
<p>The question is exactly what the title says. I am a student attending a rather large high school in South Carolina. In order to block to youtube, proxies, games, etc., the school has disabled SSL and TLS (secure socket protocol for web security). These are standards for all web browsers (I get a warning on my MAC that there may be an attack on my computer if I even get on their wifi and open Safari), and what is even more scary (and angering) to me is that they have a fake google certificate which they do not inform people of in any way or agreement. I understand that I am a minor and am resigned that I can do nothing about it, but this must illegal. I cannot imagine what the consequences would be if I did the on a private server. The vulnerability is further irresponsible because it leaves people's private data being transferred over the school network (such as private e-mail, logins) unsecured and open to packet sniffing.</p>

<p>This is more than a comment (too long), but not a definitive answer (since I am unfamiliar with the laws regarding this kind of thing). Please forgive me.</p>

<p>First, there are some technical misunderstandings. They are not disabling SSL/TLS. Instead, they are inserting themselves in between these connections so they can make sure you aren't accessing material you are not allowed to access. They may actually be required to do this by law.</p>

<p>Here is how it works. Typically when you connect to, say Google.com, you are given a certificate from Google.com that has a trusted chain all the way up to some trusted root. That trusted root is explicitly trusted by your web browser manufacturer. In order to be able to inspect these sorts of connections, security appliances will actually replace the certificate provided by Google.com with one that the appliance provides. It has to pretend to be Google.com so your browser doesn't freak out. The problem is, this certificate is no longer has a trusted chain to something that the browser manufacturer trusts. It is provided by the security appliance. So often, the appliance will have a root certificate that the administrators of the system must install on every machine they control. Then the browsers on these machines will not complain that the certificate is invalid.</p>

<p>Obviously, you are getting the error on your own machine because you have not allowed the administrator to install these certificates on your machine. Nor should you. <strong>You should definitely not allow your school's network administrator to install these certificates on your personal computer.</strong></p>

<p>You say that "leaves people's private data being transferred over the school network (such as private e-mail, logins) unsecured and open to packet sniffing". This is not true. Any HTTPS website you visit is encrypted between your computer and the security monitoring appliance using the pretend certificate I mentioned above. Typically then, the traffic is decrypted and inspected by the appliance. Then it is re-encrypted using the real certificate, before being pushed out onto the internet. So, only at the security appliance is data turned back into the clear, only to be protected again before going out to the internet.</p>

<p>So, is this illegal?</p>

<p>Well, I think you would agree that definitely on the computers that your school owns, they can do anything they want with them. The computers belong to them. Furthermore, the network belongs to them. Likely you signed an agreement (or agree to it each time you connect) that they are allowed to monitor your usage of their computers and their network. This includes when connecting your personal machine to <strong>their</strong> network.</p>
