TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

HTTPS Client Identification Using SSL/TLS Fingerprinting

44 pointsby ins0over 9 years ago

5 comments

ins0over 9 years ago
[paper] <a href="http:&#x2F;&#x2F;is.muni.cz&#x2F;repo&#x2F;1299983&#x2F;https_client_identification-paper.pdf" rel="nofollow">http:&#x2F;&#x2F;is.muni.cz&#x2F;repo&#x2F;1299983&#x2F;https_client_identification-p...</a><p>[slides] <a href="http:&#x2F;&#x2F;is.muni.cz&#x2F;repo&#x2F;1299983&#x2F;https_client_identification-slides.pdf" rel="nofollow">http:&#x2F;&#x2F;is.muni.cz&#x2F;repo&#x2F;1299983&#x2F;https_client_identification-s...</a>
nickysielickiover 9 years ago
This is a <i>huge</i> issue. We really need leaders to start being aggressive with bringing down the variation. It&#x27;s damaging the benefit of using TLS at all, and I&#x27;d argue browser vendors would be making their users safer by having browsers force HTTP (or outright reject) on websites that aren&#x27;t maintained enough to do TLS1.2 than allowing HTTPS and ultimately hurting the whole ecosystem.<p>I don&#x27;t see a mention of timing in this paper, either. I suspect that it is another viable identifier. After accounting for latency, the speed of the response can give you an idea of what hardware they&#x27;re using.
cm2187over 9 years ago
I don&#x27;t really get the point of getting the user agent with this technique. How useful is it? It&#x27;s not really fingerprinting. You can&#x27;t identify a computer uniquely. Pretty much all iphones have the same user agent.
评论 #10190242 未加载
yuhongover 9 years ago
OpenSSL has a hack similar to this to workaround a bug in Apple&#x27;s ECDSA implementation where it was unusable in older versions of OS X and iOS.
kylequestover 9 years ago
Dropping &quot;Network-based&quot; from the name makes it a bit misleading&#x2F;confusing...