(4) Web Browser & Web Server

(5) Web Intermediaries

(6) Intermediary Servers

• The most common type of intermediary is called a proxy server
• A proxy server is a separate computer between the client (computer on which the browser is running) and server
• Proxy servers may be set up by the people operating a specific network (e.g) at a school or company)
• Or they may be configured by an end user, in their browser settings or operating system settings

(7) Intermediaries in the Browser

• Intermediaries are usually separate computers between the client and server
• But we can also think of things like browser add-ons and extensions [Web Browsers; Add-Ons (1)] as intermediaries running in the browser
  • Firefox: Add-ons [https://addons.mozilla.org/en-US/firefox/], user scripts [http://userscripts.org/], jetpacks [https://jetpack.mozillalabs.com/]
  • IE: Add-ons [http://www.ieaddons.com/], userscripts [http://iescripts.org/]
  • Chrome: Extensions [https://chrome.google.com/extensions]
  • Safari: Plugins [http://pimpmysafari.com/] (not to be confused with the other kind of plug-in [Web Browsers; Plug-Ins (1)])

(9) Modifying requests

• Redirecting the request
• Modifying request headers
• Modifying form values
• Adding/removing cookies

(10) Modifying responses

• Inserting or removing content
• Translating: formats, languages
• Adapting or compressing
• Adding annotations or overlays

(11) Passive monitoring

• Logging statistics
• Recording links followed
• Storing copies of documents

(13) Improving Performance

• Intermediaries are often used to improve performance (faster browsing) and save bandwidth
• Rather than downloading content from a distant server, browsers can download from a server that is geographically close or connected by a fast (short) network link
• This kind of intermediary is called a cache
• Caches exist at different locations:
  • Caching in the browser
    • very close and fast, but only has copies of what a single user has downloaded
  • Caching in an organization's network
    • still close, and has copies of what everyone in the organization has downloaded--save the organization's bandwidth costs
  • Caching in a content distribution network
    • used by companies that want their content to be accessible quickly everywhere

(14) Content Distribution Network

Amazon CloudFront [http://aws.amazon.com/cloudfront/]

(15) Content Modification

• Intermediaries can be used to modify content
• Removing ads is a popular use of intermediaries
• NebuAd [http://en.wikipedia.org/wiki/NebuAd] got in trouble for using intermediaries to insert ads
• A more benign form of content modification is adaptation for mobile devices: CNN.com [http://cnn.com], CNN.com adapted for mobile [http://www.google.com/gwt/n?q=cnn.com&site=search&hl=en&lr=&c2coff=1&safe=off&mrestrict=xhtml&ct=res&cd=1&rd=1&u=www.cnn.com/]

(16) Protecting Privacy

• An intermediary may be used to provide anonymity or protect privacy
  • Hide IP address of the client
  • Removing information from HTTP headers
  • Remove cookies or substitute fake ones
  • Generate fake "noise" activity to confuse monitoring
• This can happen at different levels
  • In the browser, e.g. TrackMeNot [http://mrl.nyu.edu/~dhowe/trackmenot/]
  • In an organization's network, e.g. Tor [http://www.torproject.org/], GoogleSharing [http://www.googlesharing.net/]
  • On the Web: anonymous proxies (but be careful! [http://en.wikipedia.org/wiki/Anonymizer#Risks_and_security])

(17) GoogleSharing

(18) Access Control

• Intermediaries are often used for access control
• Access control means both blocking and enabling access to resources
• Our library uses a proxy [http://www.lib.berkeley.edu/Help/proxy.html] for enabling access to subscription resources for off-campus users
• Schools and companies often use proxies for blocking access to porn, gambling, time-wasting sites
• Control may occur at the URI level, or by actually examining the content of web pages
• Whether it's used by companies [http://www.ironport.com/technology/ironport_web_usage_controls.html] or governments [http://www.theatlantic.com/magazine/archive/2008/03/-ldquo-the-connection-has-been-reset-rdquo/6650/], it's the same technology

(19) Monitoring & Surveillance

• Even if they're not actively blocking content, most companies passively monitor employee's web usage
• Be careful what you browse at work!
• China's "Golden Shield" program relies as much on people's fear of being passively monitored as it does on actively blocking access
• Monitoring can have positive uses as well
• Statistics on usage of subscription resources can help organizations with planning
  • what isn't getting used?
  • who are the heaviest users?
  • should we be caching more?