Tell me why, I don’t like Proxies

Inspired by a discussion on twitter, I find myself once more in the position of having to explain why I am not a fan of the use of proxy referral services in libraries. I should start by saying that I am not a fan of the typical trend of using IP access on library campuses and it is the general move away from any sort of IP-based system that I am actually promoting. I also completely understand why libraries like to use them – the best known proxy products are quick, clean and easy to implement and maintain.

Sometime ago, JSTOR took a strong position on the use of proxy servers, noting:

Without special configuration, these proxy servers often have no access restrictions in place. If the computer is within a range of IP addresses that have access to JSTOR, then the result is that literally anyone in the world can use that proxy server to enter JSTOR, as well as other licensed electronic products and restricted campus resources. It is important to note that this is not a fault of any institution or library, but a weakness inherent in the current system of using IP addresses for authentication to restricted resources.

Now, most library proxies are well enough set-up that they are not providing an open proxy access route. However, easy to set up can sometimes mean sloppily set up, particularly in the use of administrative passwords. We have had many examples of the administrative passwords to proxy servers being made available freely on the internet. So if you are going to use a proxy, make sure that administrative passwords are well looked after and frequently changed – they provide access to nearly ALL your resources!

My second point is that proxies are often set-up without much thought to the credentials being used with the proxy server. Sometimes, only a small set of credentials are used or credentials that a user would have no qualms in sharing. So again, if you are setting up a proxy server tie-in a sensible credential option such as local authentication using shibboleth to increase security.

Thirdly, I just don’t like something that pretends to be something it is not. When using the proxy service, you are basically claiming to be visiting the Service Providers in question from an agreed set of IP addresses ‘owned’ by an institution. In reality, you could be on any computer anywhere in the world. There are a host of security issues that have been caused from such a set up.

Fourthly, there is the problem of accounting and statistics. It is very difficult to provide authoritative data on resource use from proxy servers, or from IP access for that matter! In a time where we need to justify spending constantly, it seems that better resource usage statistics can only be a good thing. I’ve heard this as an argument away from proxies from Service Providers as well – they would like to better understand the market they are serving rather than just receiving access requests from an IP-range.

Finally, there is the user experience. Proxies mirror IP access and plain old IP access routes don’t offer much added value for the user such as personalisation etc.

I really do understand why libraries use proxies, and why they continue to use IP access on-site. There is a particular job of work to be done with US-based publishers on pushing the advantages of more sophisticated access routes and moving away from IP-based licenses. We continue to work with publishers. In the meantime, I hope it is OK if I continue to see the place and role of proxies, but continue to shudder and dislike them. Maybe I am just suffering from access management OCD.

In the meantime, maybe you can tell me why on-site IP access is really a good thing for the user??