[gametheory]

no, they just pass it along to the service listening on that port. How would you verify HTTPS without decrypting it?

[jacobolus]

Let’s be careful here.

Yes there are firewalls/proxies which check for validity of HTTP over port 80, though others don’t bother, or just look at the first bit of traffic for each connection.

HTTPS goes over port 443, and I imagine there are some firewalls somewhere or another which block it altogether. Probably not enough of them to worry too much about though.

Some firewalls at least make sure that traffic over port 443 does a proper SSL handshake.... after that the data is encrypted, so they have no way to tell just what’s going through.

[lhorie]

So would FlashSocket traffic get blocked by these firewalls if it was trying to sneak in through port 80, then? That would kinda beat the purpose of this effort.

[colonelxc]

Even if your firewall doesn't track it, you could set up an IDS system to detect and alert on it, if you were into that sort of thing.

[msmith]

You don't need to be able to decrypt anything to identify an HTTPS flow. An unencrypted SSL/TLS handshake takes place first, before any encrypted data is sent across the wire.

Some firewalls can track this.

[Saavedro]

Right. But you can still run whatever protocol you like -on top- of SSL.

[lhorie]

Hah. Good point. Thanks.