What is a Public Web Proxy?
The role of a proxy server is to act as an intermediary between a web user and the website they are visiting, and a public web proxy is a proxy server that is accessible to anyone. Public web proxies may be used to conceal the user’s IP address, bypass restrictions, or bypass firewalls.
However, public web proxies also have their downsides, such as the potential for surveillance by the proxy provider. This is a major reason why enterprise users should use a secure, cloud-native solution rather than legacy proxies.
Understanding Public Web Proxies
The role of a web proxy is to provide a level of privacy to one end of a web browsing session. Some proxies are deployed to protect users, while others may be designed to shield an organization’s servers from the public Internet. Public web proxies are freely accessible to anyone on the Internet and route traffic through an external server. They’re commonly used to circumvent geoblocking, content restrictions, or basic firewalls filtering solely on source IP address.
However, while these systems theoretically provide anonymity, they only conceal the user’s identity from the target website. The proxy provider, on the other hand, has visibility into all of the traffic funneled through it, enabling it to build a much more complete picture of a user’s browsing habits.
Definition and Basic Function
A public web proxy is a server designed to act as an intermediary for web browsing. It is publicly accessible and used to conceal the source IP address. This allows users to circumvent geoblocking and content restrictions and provides a degree of privacy.
Often, these proxies are accessed via websites or browser extensions and don’t require authentication. They’re commonly confused with virtual private networks (VPNs), which encrypt network traffic between the user and the proxy, protecting against eavesdropping.
How Public Proxies Differ from Private or Enterprise Proxies
At a high level, public web proxies play a similar role to enterprise or private proxies. They act as an intermediary between the web user and server, offering a level of privacy protection.
However, private and enterprise proxies typically integrate various security features that public web proxies lack. These include:
- User authentication and access management
- Encryption
- Traffic inspection and policy enforcement
- Logging and monitoring
This makes a profound difference to an organization’s security and compliance efforts. With a public proxy, an organization can achieve some privacy protection and evade geo-restrictions at the cost of monitoring by the proxy provider. An enterprise proxy, on the other hand, provides visibility into all traffic passing through it, complying with security policies and regulatory requirements.
Risks and Limitations of Public Web Proxies
Public web proxies can be convenient and offer many of the features of a proxy that an end user desires. However, they also have significant downsides in terms of security, performance, and regulatory compliance, which is why they are largely obsolete in enterprise environments.
Security Risks (Logging, Malware Injection)
Most public web proxies aren’t configured to tunnel HTTPS traffic, so they break the HTTPS connection. This can be accomplished either by only supporting HTTP traffic or allowing the user to establish an HTTPS connection only to the proxy itself, not the target webpage. As a result, they have full visibility into and control over the web content flowing through them.
Public web proxies are typically free, which means they need to make money somehow. Often, they accomplish this by tracking and selling user data or injecting ads or scripts into page content. Cybercriminals may also create fake proxy sites with the intention of harvesting credentials or injecting malware into legitimate webpage content. Since users have little to no visibility into the entity running the proxy, it’s difficult to determine if one is legitimate or what it does with the data at its disposal.
Reliability and Performance Pitfalls
Free web proxies are shared services available to anyone on the Internet. They can suffer poor performance, such as latency or timeouts, for various reasons, including:
- Traffic overload
- IP blacklisting by common and popular services
- Bandwidth throttling
As a result, the performance of a free web proxy may not meet enterprise needs. In contrast, a paid, cloud-based service can scale to meet demand and optimize network performance and latency.
Compliance and Visibility Concerns
Public web proxies offer no centralized visibility or logging, except for the proxy provider. This can threaten an organization’s compliance with regulations, such as GDPR, HIPAA, and PCI DSS. Additionally, enterprises using public proxies are exposed to potential data loss, shadow IT, and an inability to effectively enforce access policies.
Proxy vs. Secure Web Gateway vs. SASE
Enterprises may adopt public web proxies to achieve various goals, but they’re certainly not the only option to do so. Some alternative options that meet many of the same needs but address the major limitations of web proxies include Secure Web Gateways (SWGs) and Secure Access Service Edge (SASE).
What is a Secure Web Gateway (SWG)?
An SWG is a network security solution designed to protect users against web-based threats, such as phishing pages and malware. Like a proxy, all web traffic flows through the SWG, but an SWG performs inspection to filter URLs, scan for malware, and implement data loss prevention (DLP).
SWGs are designed for enterprise users and implement in-depth visibility, access control, policy enforcement, and logging. They’re often made available as cloud-based services or via edge PoPs to address potential network performance issues. In contrast, public proxies lack visibility and security features and can be overwhelmed by too much traffic.
How SASE Integrates Proxy Functionality and Extends It
A SASE platform converges several security and network capabilities into a single, cloud-native security solution. This includes SWG as well as Firewall as a Service (FWaaS), Zero Trust Network Access (ZTNA), Cloud Access Security Broker (CASB), and Software-Defined Wide Area Network (SD-WAN).
With SASE, all enterprise traffic flows through a SASE PoP for inspection – including support for TLS inspection – and policy enforcement en route to its destination. This enables an organization to consistently enforce security policies across the enterprise and enhances visibility, security, and performance, especially for hybrid work and BYOD.
FAQs about Public Web Proxy
Can public web proxies encrypt data?
While public web proxies can tunnel HTTPS traffic and preserve encryption, the majority do not. Instead, they generally only support HTTP traffic or will encrypt traffic only between the user and the proxy itself.
Are public proxies legal to use?
In most countries, the legality of using a proxy depends on the use case, so using it to bypass geoblocking may be legal, but using it for fraud definitely is not. For enterprises, the use of web proxies could permit illegal activity and create legal liability, and may render the organization non-compliant with regulatory requirements.
Can enterprises use public proxies securely?
Public proxies aren’t built for enterprise use cases, and they lack key features such as authentication, policy control, and monitoring. A better solution is a SWG or SASE platform, like Cato, that offers these critical security features.
How can an organization transition off public proxies?
To start, the organization should perform a security audit to determine the current use of public proxies and the use cases that they support. From there, the company can determine whether an SWG or an all-in-one SASE solution is the best option for their use case.
Why Migrating from Public Web Proxy Makes Sense
Public web proxies provide useful functionality, but they introduce numerous security risks and lack key enterprise features, such as network visibility, control, and regulatory compliance. Making the move to a secure alternative built to meet enterprise needs — like Cato SASE Cloud — addresses these issues and better meets the needs of modern work environments, which may need to support hybrid work or BYOD.
Explore how Cato Networks eliminates legacy proxies with a unified SASE platform. Request a demo to experience modern, secure web access.