Web security
HTTPS and the
Lock Icon
Dan Boneh
Goals for this lecture
Brief overview of HTTPS:
• How the SSL/TLS protocol works (very briefly)
• How to use HTTPS
Integrating HTTPS into the browser
• Lots of user interface problems to watch for
Dan Boneh
Threat Model: Network Attacker
Network Attacker:
• Controls network infrastructure: Routers, DNS
• Eavesdrops, injects, blocks, and modifies packets
Examples:
• Wireless network at Internet Café
• Internet access at hotels (untrusted ISP)
Dan Boneh
TLS overview: (1) DH key exchange
Anonymous key exchange secure against eavesdropping:
The Diffie-Hellman protocol in a group G = {1, g, g2, g3, …, gq-1}
Browser Alice Server Bob
a ⟵ {1,…,q} A = ga ∈ G b ⟵ {1,…,q}
B = gb ∈ G
PMS = Ba PMS = Ab
PreMasterSecret = gab = (gb)a = Ba = (ga)b = Ab
Dan Boneh
(2) Digital signatures
Goal: bind document to author
• Problem: attacker can copy Alice’s sig from one doc to another
Main idea: make signature depend on contents of document
Def: a signature scheme is a tuple of three algorithms:
• Gen() ⇾ (pk, sk) sign msg using sk
• Sign(sk, msg) ⇾ sig verify (msg,sig) using pk
• Verify(pk, msg, sig) ⇾ ‘accept’ or ‘reject’ Dan Boneh
(2) Digital signatures
Goal: bind document to author
•Security (informal):
Problem: attacker adversary who sees
can copy Alice’s signatures
sig from on to
one doc many
another
messages of its choice, cannot forge a signature on a new
message.
Main idea: make signature depend on contents of document
Def: a signature scheme is a tuple of three algorithms:
• Gen() ⇾ (pk, sk) sign msg using sk
• Sign(sk, msg) ⇾ sig verify (msg,sig) using pk
• Verify(pk, msg, sig) ⇾ ‘accept’ or ‘reject’ Dan Boneh
(3) Certificates
How does Alice (browser) obtain pkBob ?
Browser CA
Alice Server Bob
choose pk and
(sk,pk) proof “I am Bob”
check
pkCA pkCA proof skCA
issue Cert with SKCA :
Verify Bob’s
cert Bob’s key is pk
key is pk
Bob uses Cert for an extended period (e.g. one year) Dan Boneh
22
Sample certificate:
(by CA)
Dan Boneh
Certificates on the web
Subject’s CommonName can be:
• An explicit name, e.g. [Link] , or
• A wildcard cert, e.g. *.[Link] or cs*.[Link]
matching rules:
“*” must occur in leftmost component, does not match “.”
example: *.[Link] matches [Link] but not [Link]
(as in RFC 2818: “HTTPS over TLS”)
Dan Boneh
Certificate Authorities
⋮
Browsers accept
certificates from a
large number of CAs
Top level CAs ≈ 60
Intermediate CAs ≈ 1200
⋮ Dan Boneh
(4) TLS 1.3 session setup (simplified)
Diffie-Hellman key exchange
Client ClientHello: nonceC , KeyShare Server
ServerHello: nonceS , KeyShare, Enc[certS,…] secret
CertVerify: Enc[SigS(data)] , Finished key
authenticates server
certS
Finished
session-keys ¬ HKDF( DHkey, nonceC , nonceS )
Encrypted ApplicationData
Encrypted ApplicationData
Most common: server authentication only Dan Boneh
(3) TLS 1.3 session setup: optimization (and caution)
Client ClientHello: nonceC , KeyShare , Enc[0-RTT data] Server
ServerHello: nonceS , KeyShare, Enc[certS,…] secret
CertVerify: Enc[SigS(data)] , Finished key
authenticates server
Data encrypted certS
Finished using a pre-shared key
Caution: 0-RTT data
session-keys ¬ is vulnerable
HKDF( to replay
DHkey, nonce C , nonceS )
⇒ dataApplicationData
Encrypted should have no side effects
(i.e. Encrypted
GET butApplicationData
not POST)
Most common: server authentication only Dan Boneh
Integrating TLS with HTTP: HTTPS
HTTP/2 HTTP/3
(2015) (2022)
HTTP
TLS
TLS
TCP QUIC
IP IP
TCP handshake ⇒ TLS handshake integrated handshake
(encrypting by default)
Dan Boneh
Integrating TLS with HTTP: HTTPS
web
server
A complication: client-hello
server-cert ???
certXYZ
Virtual hosting: many sites hosted at same IP address certABC
solution since TLS 1.1: SNI (2003)
client_hello_extension: server_name=[Link]
… but SNI defeats privacy benefit of encrypted cert in TLS 1.3.
Solution: enc. client hello (ECH) [encrypted with pk in server DNS]
Dan Boneh
HTTPS for all web traffic?
Old excuse:
• Crypto slows down web servers
⟹ no longer true (thanks to AES-NI)
Since July 2018: Chrome marks HTTP sites as insecure
Dan Boneh
HTTPS in the Browser
Dan Boneh
The TLS indicator (HTTP site)
(HTTPS site)
vs.
Intended goal:
• Provide user with identity of page origin
• Indicate to user that page contents were not
viewed or modified by a network attacker
Dan Boneh
When is the TLS icon displayed
All elements on the page fetched using HTTPS
For all elements:
• HTTPS cert issued by a CA trusted by browser
• HTTPS cert is valid (e.g. not expired)
• Domain in URL matches:
CommonName or SubjectAlternativeName in cert
Dan Boneh
Positive security indicators are dangerous
The lock icon is a positive security indicator. Problem: picture-in-picture attacks.
Trained users are more likely to fall victim to this [JSTB’07]
Dan Boneh
HTTPS and login pages: incorrect usage
Suppose user lands on HTTP
login page.
• say, by typing HTTP URL
into address bar
View source:
<form method="post"
action="[Link] (old site)
Dan Boneh
HTTPS and login pages: guidelines
General guideline:
Response to [Link]
should be Location: [Link]
(redirect)
Should be the response
to every HTTP request …
Dan Boneh
Problems with HTTPS
and the Lock Icon
Dan Boneh
Problems with HTTPS and the Lock Icon
1. Upgrade from HTTP to HTTPS
2. Forged certs
3. Mixed content: HTTP and HTTPS on the same page
4. Does HTTPS hide web traffic?
– Problems: traffic analysis, compression attacks
Dan Boneh
1. HTTP ⇒ HTTPS upgrade
Suppose user does:
• connect to bank site over HTTP; bank redirects to HTTPS
SSL_strip attack: prevent the upgrade [Moxie’08]
HTTP SSL
attacker web
server
<a href=[Link] ⟶ <a href=[Link]
Location: [Link] ⟶ Location: [Link] (redirect)
<form action=[Link] > ⟶ <form action=[Link]
Dan Boneh
Tricks and Details
UI design flaw in old browsers: location of fav icon
⇒ fav icon no longer presented in address bar
Number of users who detected HTTP downgrade: 0
Dan Boneh
Defense: Strict Transport Security (HSTS)
Strict-Transport-Security: max-age=63072000; includeSubDomains web
(ignored if not over HTTPS) server
Header tells browser to always connect over HTTPS
Subsequent visits must be over HTTPS (self signed certs result in an error)
• Browser refuses to connect over HTTP or if site presents an invalid cert
• Requires that entire site be served over valid HTTPS
HSTS flag deleted when user “clears private data” : security vs. privacy
Dan Boneh
Preloaded HSTS list
[Link]
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Preload list hard-coded in Chrome source code. Examples:
Google, Paypal, Twitter, Simple, Linode, Stripe, Lastpass, …
Dan Boneh
CSP: upgrade-insecure-requests
The problem: many pages use <img src=“[Link]
• Makes it difficult to migrate a section of a site to HTTPS
Solution: gradual transition using CSP
Content-Security-Policy: upgrade-insecure-requests
<img src=“[Link] <img src=“[Link]
<img src=“[Link] <img src=“[Link]
<a href=“[Link] <a href=“[Link]
<a href=“[Link] <a href=“[Link]
Dan Boneh
2. Certificates: wrong issuance
2011: Comodo and DigiNotar CAs hacked, issue certs for Gmail, Yahoo! Mail, …
2013: TurkTrust issued cert. for [Link] (discovered by pinning)
2014: Indian NIC (intermediate CA trusted by the root CA IndiaCCA) issue certs
for Google and Yahoo! domains
Result: (1) India CCA revoked NIC’s intermediate certificate
(2) Chrome restricts India CCA root to only seven Indian domains
2016: WoSign (Chinese CA) issues cert for GitHub domain (among other issues)
Result: WoSign certs no longer trusted by Chrome and Firefox
⇒ enables eavesdropping w/o a warning on user’s session
Dan Boneh
Man in the middle attack using rogue cert
GET [Link] BadguyCert BankCert
ClientHello attacker ClientHello bank
ServerCert (rogue) ServerCert (Bank)
(cert for Bank by a valid CA)
TLS key exchange TLS key exchange
k1 k1 k2 k2
HTTP data enc with k1 HTTP data enc with k2
Attacker proxies data between user and bank.
Sees all traffic and can modify data at will.
Dan Boneh
What to do? (many good ideas)
1. Public-key pinning (static pins)
– Hardcode list of allowed CAs for certain sites (Gmail, facebook, …)
– Browser rejects certs issued by a CA not on list
2. Certificate Transparency (CT): [LL’12]
– idea: CA’s must advertise a log of all certs. they issued
– Browser will only use a cert if it is published on (two) log servers
• Server attaches to certificate a signed statement from log (SCT)
• Companies can scan logs to look for invalid issuance
Dan Boneh
CT requirements
April 30, 2018: CT required by chrome
• Required for all certificates with a path to a trusted root CA
(not required for an installed root CA)
• Otherwise: HTTPS errors
Cert for [Link]
published on five logs:
cloudflare_nimbus2018
google_argon2018, google_aviator
google_pilot, google_rocketeer
Dan Boneh
3. Mixed Content: HTTP and HTTPS
Page loads over HTTPS, but contains content over HTTP
(e.g. <script src=“[Link] )
never write this
⇒ Active network attacker can hijack session
by modifying script en-route to browser
IE7: Old Chrome:
Mostly ignored by users … Dan Boneh
[Link] (Chrome 124, 2024)
Mixed script: <script src="[Link]
(no visible warning)
script is not loaded! developer tools show an error.
Mixed form: <form action="[Link]
Warning if user tries to submit data
Dan Boneh
4. Peeking through TLS: traffic analysis
• Network traffic reveals length of HTTPS packets
– TLS supports up to 256 bytes of padding
• Some sites interact frequently with the web server
– These interactions expose specific internal state of the page
Chen, Wang, Wang, Zhang, 2010 (tax web site)
BAM!
IOactive, 2012 (Google maps)
Dan Boneh
Peeking through TLS: an example [CWWZ’10]
Vulnerabilities in an online tax application
No easy fix. Can also be used to ID Tor traffic
Dan Boneh
THE END
Dan Boneh