<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
-----BEGIN PGP SIGNED MESSAGE----- <br>
Hash: SHA256 <br>
<br>
<br>
<br>
24.08.2016 19:24, Antony Stone пишет:<br>
<span style="white-space: pre;">> On Wednesday 24 August 2016 at
14:35:03, Yuri Voinov wrote:<br>
><br>
>>>> Then I do not understand what he wants op.<br>
>><br>
>>
<a class="moz-txt-link-freetext" href="http://wiki.squid-cache.org/Features/HTTPS#Encrypted_browser-Squid_connecti">http://wiki.squid-cache.org/Features/HTTPS#Encrypted_browser-Squid_connecti</a><br>
>> on<br>
>><br>
>>> Secure connection to squid proxy without need for
anything else (on<br>
>>> client side) than configuring proxy in browser.<br>
>><br>
>>> Using provided signed certificates.<br>
>>> No SSL-bumping or whatever just forwarding.<br>
>><br>
>> Firstly, the concept is not safe. Users will have a
secure connection to<br>
>> the proxy<br>
><br>
> Yes, that is all the OP is looking for.<br>
><br>
>> as well as the next?<br>
><br>
> Once it leaves the OP's network I suspect the risk (of
eavesdropping etc) is <br>
> reduced.<br>
><br>
>> HTTP? User misled green padlock,<br>
><br>
> I do not think the browser will show an SSL/TLS padlock for a
secured proxy <br>
> connection - it only shows this for a secured connection to
the destination <br>
> server. Therefore no misled users.<br>
><br>
>> believes all secure connection - as external traffic is
not encrypted<br>
>> after the fact. Second. You seriously think that the
world will sit<br>
>> under HTTPS? What, for example, you want to protect on
news sites?<br>
><br>
> I don't understand what you are saying here.</span><br>
May be some misunderstanding here.<br>
<br>
If we are talking about encryption, just authentication proxy - is
one thing. If encryption of all client traffic at all only to the
proxy, not caring about what happens to it next - is another.<br>
<br>
<span style="white-space: pre;">><br>
> The connection across the local network between browser and
proxy is secured.<br>
><br>
> Beyond that everything works across the Internet just as
normal - HTTP sites <br>
> are not secured, HTTPS sites are secured. The user sees SSL
padlock and <br>
> certificate chain for HTTPS sites, nothing for HTTP sites.<br>
><br>
> So, the design is more secure over the local network than the
standard <br>
> arrangement, and exactly the same beyond the local network.</span><br>
Correct LAN design solves most of these problems.<br>
<span style="white-space: pre;">><br>
><br>
> No security is being compromised or downgraded.</span><br>
Not sure.<br>
<span style="white-space: pre;">><br>
><br>
><br>
> Antony.<br>
></span><br>
<br>
-----BEGIN PGP SIGNATURE-----
<br>
Version: GnuPG v2
<br>
<br>
iQEcBAEBCAAGBQJXvaF5AAoJENNXIZxhPexG7MMH/RYfzKl3PMQFBtbjZ8jg6Jra
<br>
4dtgJifJTLjSsF0NSqRtT/iZ8KpW3SrSJ+10Ht9IoVbjGiAL8p8/FMLh8/ImTmqJ
<br>
QxqI0ovLgj/YuHoxlm4U25L7NG0amzUTINhNXRw79Yvp5RxNEyAmfFpy0mAfD34h
<br>
ClXQQeWsCalS8Wz7yGqpgp28T9m86l3BNe+SoP+Q1/tfIkopcGD4Hz32N32J/Bsm
<br>
Wen8JMW2f6BAa0mIbb+tV9q1dI5stommTtprCzi8kAtzqX2bbBt3Nnz+xXQWZmwZ
<br>
tEO9CsLN4fTSUGILLQG2Bv5ZyT0tAFvhxzCBoz8hpBO+NcIPkm5OgkzpGe32/NA=
<br>
=A9CF
<br>
-----END PGP SIGNATURE-----
<br>
<br>
</body>
</html>