Sciweavers

Share
NDSS
2015
IEEE

Upgrading HTTPS in mid-air: An empirical study of strict transport security and key pinning

3 years 6 months ago
Upgrading HTTPS in mid-air: An empirical study of strict transport security and key pinning
—We have conducted the first in-depth empirical study of two important new web security features: strict transport security (HSTS) and public-key pinning. Both have been added to the web platform to harden HTTPS, the prevailing standard for secure web browsing. While HSTS is further along, both features still have very limited deployment at a few large websites and a long tail of small, security-conscious sites. We find evidence that many developers do not completely understand these features, with a substantial portion using them in invalid or illogical ways. The majority of sites we observed trying to set an HSTS header did so with basic errors that significantly undermine the security this feature is meant to provide. We also identify several subtle but important new pitfalls in deploying these features in practice. For example, the majority of pinned domains undermined the security benefits by loading non-pinned resources with the ability to hijack the page. A substantial por...
Michael Kranch, Joseph Bonneau
Added 15 Apr 2016
Updated 15 Apr 2016
Type Journal
Year 2015
Where NDSS
Authors Michael Kranch, Joseph Bonneau
Comments (0)
books