Characterizing the HTTPS Trust Landscape: A Passive View from the Edge

Abstract

Our society increasingly relies on web-based services like online banking, shopping, and socializing. Many of these services heavily depend on secure end-to-end transactions to transfer personal, financial, and other sensitive information. At the core of ensuring secure transactions are the HTTPS protocol and the "trust" relationships between many involved parties, including users, browsers, servers, domain owners, and the third-party Certification Authorities (CAs) that issue certificates binding ownership of public keys with servers and domains. This article presents an overview of the current trust landscape and provides statistics to illustrate and quantify some of the risks facing typical users. Using measurement results obtained through passive monitoring of the HTTPS traffic between a campus network and the Internet, we provide concrete examples and characterize the certificate usage and trust relationships in this complex landscape. By comparing our observations against known vulnerabilities and problems, we highlight and discuss the actual security that typical Internet users (such as the people on campus) experience. Our measurements cover both mobile and stationary users, consider the involved trust relationships, and provide insights into how the HTTPS protocol is used and the weaknesses observed in practice. While the security properties vary significantly between sessions, out of the 232 million HTTPS sessions we observed, more than 25% had weak security properties.

A First Look at the CT Landscape: Certificate Transparency Logs in Practice

“…All these four logs include 1-3% such entries. This is consistent with the 1.3% authority and 5.6% leaf certificates we observed on campus [22].…”

“…Furthermore, to understand how representative the observed certificates of the different logs are compared with what a typical internet user sees, we also use a one-week long complementary dataset collected by passively monitoring the Internet traffic to/from the University of Calgary, Canada [22]. Using Bro, we log specific information about the non-encrypted part of the TLS/SSL handshake, including all digital certificates sent.…”

“…Figure 2(a) breaks down the use of SHA1 and SHA256 across the logs. As reference points we also include values by Durumeric et al [9] (Aug. 2013) and the university dataset (Oct. 2015) [22]. We note that most of the logs have numbers in-between those observed in the wild in 2013 and 2015, and that Plausible has a smaller fraction SHA1 usage than the three older Google logs.…”

Optimal Network-Assisted Multiuser DASH Video Streaming

“…1) BDRA Scheme with Secure Video Streaming: HTTP secure (HTTPS) is a newly emerging variant of the HTTP protocol in order to offer increased levels of privacy and security to end users on-demand [27], [28], [29]. In particular, video streaming services such as YouTube and Netflix already provide the secure end-to-end connection option through HTTPS connection.…”

X.509 Certificate Error Testing

“…The hash algorithms range from MD5 to SHA. Due to the proven MD5 collisions [4] and weaknesses with SHA1 it means that at a minimum SHA256 should be used for hashing [9].…”