HSTS Preloading is Ineffective as a Long-Term, Wide-Scale MITM-Prevention Solution: Results from Analyzing the 2013 - 2017 HSTS Preload List

Autor:	Roig, JV, Gatdula, Eunice Grace
Rok vydání:	2019
Předmět:	Computer Science - Cryptography and Security
Druh dokumentu:	Working Paper
Popis:	HSTS (HTTP Strict Transport Security) serves to protect websites from certain attacks by allowing web servers to inform browsers that only secure HTTPS connections should be used. However, this still leaves the initial connection unsecured and vulnerable to man-in-the-middle attacks. The HSTS preload list, now supported by most major browsers, is an attempt to close this initial vulnerability. In this study, the researchers analyzed the HSTS preload list to see the status of its deployment and industry acceptance as of December 2017. The findings here show a bleak picture: adoption of the HSTS Preload List seem to be practically nil for essential industries like Finance, and a significant percentage of entries are test sites or nonfunctional. Comment: Very short. Supports the need to go HTTPS-everywhere ASAP - opt-in solutions just don't work
Databáze:	arXiv
Externí odkaz:	http://arxiv.org/abs/1905.04436 Zobrazit plný text záznamu View this record from Arxiv