What College is this? Is it public or private?

This really needs to be stopped. Please reveal who the guilty party is.

@R.. here where I live we have a term for such behavior: "The Owner of the Ball." - the kid that owns the ball everyone uses to play with, and threatens to unfairly deny access to said ball if everyone does not agree to play by his unbalanced rules. Yes, this needs to be stopped.

@R.. "but, but, if the government does it, what evil is there in me doing it too?"

I'm not up to speed on the legal intricacies of such a thing in America (I assume?), but I wonder if this might possibly be illegal? Do you not have an expectation of privacy on a network like that, to which there is presumably no alternative, and which is reasonably used for private activities (Internet banking, etc.)? If so then perhaps you should look into gathering as many of you together as possible and starting a law suit (after threatening with one of course).

Just to be clear. They will be intercepting the traffic regardless of whether you install the certificate. Installing the certificate will just silence your browser's warnings about it.

@tjd: No. It's a browser error not a warning, and no traffic except connection attempts will take place (and thus none will be available for interception) unless you install the certificate or manually bypass the error and tell the browser to ignore the invalid site certificate. Good browsers should not even let you do this.

@R: Browsers allow you to 1) permanently ignore the invalid certificate (Install), 2) temporarily ignore the invalid certificate without actually installing it or 3) abandon the connection. At the UI level, any real difference between the words "Error" and "Warning" here seem to be primarily spelling, particularly when the average user's response is "Where's the 'make it work' button?".

@tjd: It's a big difference from what you said even with a warning, because no traffic actually takes place to get intercepted until the user allows it. "They will be intercepting the traffic regardless of whether you install the certificate." is factually incorrect unless by traffic you just meant dns, tcp connection attempt, and sni label or something.

Just because you're in college doesn't mean you're no longer subject to "my house, my rules" ultimatums. It's just that instead of being in your parent's house, you're in [insert institution's name here]'s "house". Don't want to be spied on? Don't use their network.

@Iszi: This sort of spying is unethical and arguably illegal, and tolerating it anywhere puts everybody's security at risk. Apologist comments like yours are not helpful.

@R..tjd's point is that so long as the OP uses their network, and assuming they (as most users will) just click-through the warnings so that they can go about their business somewhat normally, all traffic will be monitored regardless of whether the OP actually "installs" the certificate or not.

@Iszi: That's true. Of course refraining from installing the certificate still has some benefit: it prevents silent MITM when you connect to other networks (since you'll see the warnings/errors again).

is that even legal? I would take a legal course of action if I were you

The real problem with these sorts of regimes is that the users are generally not informed about the Proxy TLS box's behavior regarding sites with truly invalid certificates.

Probably not a full answer, but there is a TLS Proxy box on my network that has trouble with ECDHE and passes it right on through. Careful cipher suite selection in your browser, while a bit of work, may have some merit.

@WChargin They are similar in that a certificate is a signed (public) cartographic key. They differ in usage. The SSL certificate is used during the negotiation of a session key. A CA certificate, is used to verify the signatures made by it's matching private key. A root CA certificate is one that verifies the signatures on other CA certificates and is commonly either installed with a browser or OS or installed after the fact by those who choose to trust that CA. You can choose to install/trust either type.

@WChargin, where they are similar is in how ssl works with regard to verifying certificates. To initiate an HTTPS connection, you only need to verify that the certificate is either issued from a root CA you trust, or is one of the certificates you installed. In that sense, once a given certificate is installed on a client, it can be used to spoof any https connection, because there is no verification beyond trusting the certificate

And really, please post which college this is (unless there is a reason why that would be illegal to communicate publicly about the T&Cs of the college network?)

@R.. The ethicality of this is very context-sensitive, and university networks can be pretty fuzzy in that regard because they tend to contain both "work" and "home" environments. For a purely work-oriented network though, the issue is fairly unambiguous. You wanna browse Facebook without being spied on? That's not what the work computer/network is for. Worried they're gonna sniff your passwords? You shouldn't be using the same passwords at work that you do for personal accounts anyway.

As long as they are not forcing you to use their network ... Whenever you enter my house I may request you to take of your shoes. If you don't want to do so because you are ashamed of showing the holes in your socks or are afraid to get some infection from my carpet - you don't have to enter my house really

@HagenvonEitzen, bad analogies are always bad. removing shoes cannot be compared to reading your mail. your house is not literaly on the way to getting that degree. A slightly less bad analogy would be: to go to this place where you really want to go, you have to go through my house. I am not telling you what all the rules are in the house, but consider the last time you spent 3 hours at the airport for customs, and that will give you an idea of the baseline.

@Mindwin I'm afraid I don't get your analogy... why should someone who owns a ball not be allowed to deny others the use of the ball, under whatever conditions they feel like? (Even ridiculous conditions: "only people whose first name contains exactly three vowels may use this ball, and only during prime-numbered hours")

@immibis: Because we live in a world that has laws to prevent that kind of abuse. For the same reason a landlord cannot force you to accept them coming into your room in the middle of the night or installing cameras in the shower as part of conditions of renting. If you don't want to let others use "your ball" at all, fine. But if you do let others use it, the terms must be non-abusive, non-predative, non-discriminatory, etc.

Note that installing extra certificates may be a violation of a policy which does not want to violate the principals of IETF BCP 188 (currently RFC 7258: "Pervasive Monitoring Is an Attack"). @immibis: I think the answer is that a ball owner should legally be allowed to, in the sense that "own" is a legal phrase. However, such anti-social behavior is not good for society, and so this should be corrected (hopefully while people are young, in a school playground, at the age where many spend time playing with a ball).

Specific problem known about this specific vendor's certificate "It is therefore possible to intercept traffic from any victim of a Cyberoam device with any other Cyberoam device - or to extract the key from the device and import it into other DPI devices"

@R.. If someone says "You may to use my ball if I may install a camera in your shower" then I see no problem with choosing not to use their ball.

Also, @svetaketu, what do you mean by "you won't be able to use their network"? I assume you won't be able to use your personal device to connect to the network. Are there shared computers you can use the network from, such as in the library, or a computer lab? Can you still access course materials over the Internet via a different connection? (Note: shared computers will have at least as much non-privacy as you get by installing the certificate, but only for stuff you do on those computers)

@immibis: This is not a forum for wacky libertarian philosophical discussions. Please take it elsewhere. Internet access is widely treated as a necessity, and for students who are living on campus, the school has a monopoly on internet access and this practice is abusive. I'm not going to continue to argue with you if you insist on disagreeing, so again, please take it elsewhere.

@R.. Heh. I am not the one who started the "wacky libertarian philosophical discussion". In fact it appears that was you, with the comment "This really needs to be stopped."

Perhaps the biggest issue with this is that it is a case of 'If you want to use my ball, let me put this little device in your kitchen', but the device allows it to view into your shower, though it does say this in a 200 page document that you agree to abide by when you install it. Which is to say, most people know the negatives of installing a camera into their bathroom but most people do not understand the negatives of putting someone else's cert as a trusted root.

@tjd "Just to be clear. They will be intercepting the traffic regardless of whether you install the certificate. Installing the certificate will just silence your browser's warnings about it." How do you propose they "intercept the traffic" if they don't have the originating sites key? If what you said was true any man in the middle could intercept any traffic, this is blatantly false.

@Sam @Sam I believe you are oversimplifying here. Yes, there are countermeasures to MITM attacks. Not trusting the Attacker's certificate is a rather important one. Installing the attacker's key into your browser, defeats that protection against a Proxy TLS style attack.

@tjd, what? If I go to chase.com and log in no one can intercept my password unless 1. They have chase's key, 2. they have broken the encryption, 3. I install another root certificate. So " They will be intercepting the traffic regardless of whether you install the certificate" Is not true unless 1 or 2 are true.

@Sam if you are using a network that requires you to install their own CA certificate, they can spoof any site's certificate and act as a man-in-the-middle with full access to all encrypted traffic, and there will be no warnings that you're not using a legitimate certificate unless you take the time to manually inspect the certificate and trace it back to which root certificate is giving authority.

So, yes, if you're using an arbitrary certificate, 2 is true: they have broken the encryption by breaking the trust chain.

In fact, any MitM attacker can already present you with any arbitrary certificate, and get full unencrypted access to both sides of your conversation. The only difference is that without installing a root certificate that the attacker has control of, your browser will warn you that your otherwise perfectly encrypted connection is probably insecure because it can't authenticate the server you're connected to.

@Ghedipunk so you agree that "regardless of whether you install the certificate" is categorically wrong?

@Sam No, that's precisely that I'm saying is true. The university here is setting up a proxy so that they can intercept all traffic, including encrypted traffic. Thus, when they see a secure request, they intercept the handshake, their proxy server handshakes with you and also handshakes with the remote host. They are terminating both sides of the TLS connection inside of their proxy.

The remote host (say, your bank site) has no way to detect this.

Your browser's only defense against this is its list of root CAs, and inspecting the certificate signature chain all the way down to the end.

If the university's proxy has the private key for a root CA that is installed on your system, then own ALL traffic without warning. However, if you didn't install that root CA, then they still own all traffic, but your browser will be complaining every step of the way.

And... the same for everyone with that private key for the CA... which given the state of proxy software security, means every attacker who even thinks you might go to that university. They own all of your traffic, if they can get a proxy in your network.