FamilyShield blocking ixquick search engine

[erp_bridge68]

Recently, FamilyShield DNS started blocking the ixquick search engine (https://www.ixquick.com), reporting:

  "This domain is blocked due to content filtering. This site was categorized in: Search Engines, Proxy/Anonymizer"

Why? This appears to be a categorization error.  https://www.google.com and https://encrypted.google.com aren't blocked by FamilyShield, and they fall in the same category.  Also, under-the-hood, ixquick uses Google (see https://en.wikipedia.org/wiki/Ixquick), so I can't rationalize why ixquick would reasonably be blocked.

I should also mention that I only see the above in browsers I do "not" use.  In Firefox 50.0.1, I see the following obtuse error, because it doesn't like what OpenDNS is doing here at all:

"Your connection is not secure

The owner of www.ixquick.com has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.

This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate."

[rotblitz]

Ixquick contains a proxy function which can be used with almost every search result.  Therefore it is categorized as Proxy/Anonymizer which is being blocked when using the FamilyShield addresses.  So everything is right and nothing wrong.

Regarding the browser warning about certificates see
https://support.opendns.com/hc/en-us/articles/227988767

[erp_bridge68]

Thanks for the reply.  Google also qualifies as a "Search Engines, Proxy/Anonymizer", as the links on this post OpenDNS post confirm:

* https://support.opendns.com/hc/en-us/community/posts/115005638647-How-Can-I-Block-Google-Images-Completely-

More bluntly, Google is a proxy search for porn images and other inappropriate content (a few searches on images.google.com will demonstrate that). 

It is partially for this reason that I believe FamilyShield -- while it is a great service! -- isn't sufficient for me for filtering content for kids computers.  So I stack a "DNS whitelist" dnsmasq server on top of that. 

In my recent testing, FamilyShield so far has been fine for adults in my house (including me) -- up until ixquick.com was blocked by default.

[mattwilson9090]

@esp_bridge68

Google.com is only categorized as "Search Engines. All other submitted categorizations, including proxy/anonymizer, have specifically been rejected.

This is the reason that ixquick is blocked by FamilyShield and Google is not. And no, the article you link to does not describe google as a proxy or functioning like one. Rather, it links to articles that describe ways that might work (until Google changes things again) to block all images (not just those belonging to particular categories) on a Google results page.

And no, Google is not a proxy search for porn images and other content. It is a search engine that provides results for the entirety of the internet that it can access, regardless of what that content is. Google does make SafeSearch available, and provides information on several ways that you can force all devices on your network to use SafeSearch. The most effective method requires your own DNS server and creating some A records, so the DNSMasq you're running could do that for you.

If FamilyShield no longer does what you need it to, you switch over to the "normal" OpenDNS servers, blacklist the categories that FamilyShield blocks, and then whitelist ixquick. That effectively sidesteps not being able to whitelist domains that are blocked by FamilyShield.

[erp_bridge68]

@mattwilson9090: Thanks for your perspective.  I may try that.  Re proxy, a "caching proxy" would be a more precise term for what Google is.  Any site which serves up the content on a different site directly (e.g. image content), rather than merely providing links to it, is a caching proxy.

[rotblitz]

After looking deeper into this topic, I have to revise my comment from above:

Ixquick.com is clearly wrongly categorized as Proxy/Anonymizer.  I have raised a support ticket #299569:

Ixquick offers an option to anonymously open search results, but this all goes to ixquick-proxy.com and never to ixquick.com. Therefore it is wrong to categorize ixquick.com as Proxy/Anonymizer, whereas ixquick-proxy.com is already categorized accordingly.

Google provides a proxy function with its translation service too, maybe also with its video and image searches, but this is a totally different story, technically and from the approach...

[Anonymous]

Hello All,

The domain categorization for ``ixquick.com`` has been revised to no longer include the categorization for Proxy/Anonymizer. Thanks to @rotblitz for submitting a ticket about the re-categorization. 

If you notice a domain that could use a review of its categorization, please create a ticket with OpenDNS support at support.opendns.com, or vote on a tag at https://community.opendns.com/

[erp_bridge68]

@rotblitz, @tratnayake:Thanks for looking into this, guys!