CS 142 Lecture Notes: Network Security Certificates CS 142 Lecture Notes: Network Security
SSL/TLS Overview Most common: only the server is authenticated Browser client-hello server-hello + {server-cert}SKCA Key exchange (several options) Random key K client-key-exchange: {K}PKserver K {HTTP data}K Most common: only the server is authenticated CS 142 Lecture Notes: Network Security
SSL Stripping Replace https:// with http:// Active Attacker Browser HTTP request HTTP request Modified response HTTP response HTTP request HTTPS request HTTP response HTTPS response Browser Server Attacker opens HTTPS session, forwards requests and responses Attacker observes private info CS 142 Lecture Notes: Network Security
CS 142 Lecture Notes: Network Security HTTPS Indicators HTTP HTTPS Firefox 10 IE 8 Click on fav icon gives pop-up on bottom. Chrome 17 CS 142 Lecture Notes: Network Security 4
Mixed Content Indicators Silly dialogs Firefox 10: no SSL indicator Chrome 17: caution sign IE 8: warning dialog, no SSL lock CS 142 Lecture Notes: Network Security
CS 142 Lecture Notes: Network Security