Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Apparently all the google ads in my gmail(https) are being filtered. I'm worried. So it means somehow the data pass through the company proxy and being filtered?

share|improve this question

Expanding on some of the other answers - assuming that your proxy isn't doing a MITM attack, all traffic through it will be encrypted, except for the very first CONNECT method, which is transmitted in the clear. This method tells the proxy the hostname and port to establish the SSL connection to. Everything after that is encrypted. So, it is possible for the proxy to block connections to "" for example.

share|improve this answer
Unless the proxy doesn't support CONNECT and the browser has to use GET https: // – grawity Sep 8 '09 at 6:06
@grawity, in which case I guess the browser cannot use the proxy at all? – Arjan Sep 8 '09 at 7:33
The proxy has to know where to connect to, and that has to be transmitted in the clear. – sybreon Sep 8 '09 at 8:15
  1. The filter may be software on your computer (assuming this is a company computer.)
  2. As indicated by emgee, the ads may not be over SSL.
  3. Some companies set up their machines with an SSL key to allow SSL connections to go through their proxies. You can check this by reading the whole chain of the SSL cert. (This is what is being alluded to as a man-in-the-middle attack by other answers, though that's stretching the definition a little.)
  4. You may also be connected to a DNS server (company's or otherwise) that is blocking resolution of the domain the ads are being served from.

Also, keep in mind that most companies have policies allowing them to view all of your activity on a company machine. Most companies also have the ABILITY to do so, it's pretty trivial. And even if the company doesn't have a policy explicitly stating this, most states give companies the implicit right: they did pay for the machine and are paying for your time, so what you do is considered theirs to monitor.

share|improve this answer
I wonder about the SSL key on the proxy, and it being visible in the certificate chain. Do you imply that some companies will set up browsers to accept self-signed certificates, and then have their proxy servers impose as, and then have their DNS redirect to the proxy? (Normal proxies that allow HTTPS traffic cannot decode the traffic. The CONNECT used to set up a connection will not yield changes in the certificate chain.) – Arjan Sep 8 '09 at 7:28
I'm afraid that there are probably companies that do exactly that. – sybreon Sep 8 '09 at 8:16
I wonder what the law would say about that. Companies that want to do this could actually simply block access, rather than wanting to peek into the communications? (I guess in the Netherlands an employer would not be allowed to peek into private email. Even more: I think business email cannot be read by anyone but the recipient either, unless the employee has been told about it in advance.) – Arjan Sep 8 '09 at 9:44
I've seen the SSL decryption/encryption on a new self-signed cert. I can't find any references to current products that do, so the big guys may have stopped. Here's an open source project that does it: And here's a corporate product I've seen in use that only filters on DNS:… – Josh Sep 8 '09 at 11:50
@Josh: Thanks for the info on law in the US. At least in Germany (I guess similar in other EU countries), laws are more restrictive for employers. Monitoring is only allowed if employees are notified beforehand, except for cases where there is a reasonable suspicion of a crime against a specific person. – sleske Feb 14 '11 at 12:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .