Does "www." mean better transport layer security?
Experience shows that most researchers and developers tend to treat plain-domains (those that are not prefixed with “www” subdomains, e.g. “example.com”) as synonyms for their equivalent www-domains (those that are prefixed with “www” sub-domains, e.g. “www.example.com”). In this paper, we analyse d...
| Main Authors: | , , |
|---|---|
| Format: | Conference item |
| Published: |
Association for Computing Machinery
2019
|
| _version_ | 1826257807441133568 |
|---|---|
| author | Alashwali, E Szalachowski, P Martin, A |
| author_facet | Alashwali, E Szalachowski, P Martin, A |
| author_sort | Alashwali, E |
| collection | OXFORD |
| description | Experience shows that most researchers and developers tend to treat plain-domains (those that are not prefixed with “www” subdomains, e.g. “example.com”) as synonyms for their equivalent www-domains (those that are prefixed with “www” sub-domains, e.g. “www.example.com”). In this paper, we analyse datasets of nearly two million plain-domains against their equivalent wwwdomains to answer the following question: Do plain-domains and their equivalent www-domains differ in TLS security configurations and certificates? If so, to what extent? Our results provide evidence of an interesting phenomenon: plain-domains and their equivalent www-domains differ in TLS security configurations and certificates in a non-trivial number of cases. Furthermore, www-domains tend to have stronger security configurations than their equivalent plain-domains. Interestingly, this phenomenon is more prevalent in the most-visited domains than in randomlychosen domains. Further analysis of the top domains dataset shows that 53.35% of the plain-domains that show one or more weakness indicators (e.g. expired certificate) that are not shown in their equivalent www-domains perform HTTPS redirection from HTTPS plain-domains to their equivalent HTTPS www-domains. Additionally, 24.71% of these redirections contains plain-text HTTP intermediate URLs. In these cases, users see the final www-domains with strong TLS configurations and certificates, but in fact, the HTTPS request has passed through plain-domains that have less secure TLS configurations and certificates. Clearly, such a set-up introduces a weak link in the security of the overall interaction. |
| first_indexed | 2024-03-06T18:24:01Z |
| format | Conference item |
| id | oxford-uuid:074f44ce-6b8f-46c2-8d72-9ebe8819e321 |
| institution | University of Oxford |
| last_indexed | 2024-03-06T18:24:01Z |
| publishDate | 2019 |
| publisher | Association for Computing Machinery |
| record_format | dspace |
| spelling | oxford-uuid:074f44ce-6b8f-46c2-8d72-9ebe8819e3212022-03-26T09:06:56ZDoes "www." mean better transport layer security?Conference itemhttp://purl.org/coar/resource_type/c_5794uuid:074f44ce-6b8f-46c2-8d72-9ebe8819e321Symplectic Elements at OxfordAssociation for Computing Machinery2019Alashwali, ESzalachowski, PMartin, AExperience shows that most researchers and developers tend to treat plain-domains (those that are not prefixed with “www” subdomains, e.g. “example.com”) as synonyms for their equivalent www-domains (those that are prefixed with “www” sub-domains, e.g. “www.example.com”). In this paper, we analyse datasets of nearly two million plain-domains against their equivalent wwwdomains to answer the following question: Do plain-domains and their equivalent www-domains differ in TLS security configurations and certificates? If so, to what extent? Our results provide evidence of an interesting phenomenon: plain-domains and their equivalent www-domains differ in TLS security configurations and certificates in a non-trivial number of cases. Furthermore, www-domains tend to have stronger security configurations than their equivalent plain-domains. Interestingly, this phenomenon is more prevalent in the most-visited domains than in randomlychosen domains. Further analysis of the top domains dataset shows that 53.35% of the plain-domains that show one or more weakness indicators (e.g. expired certificate) that are not shown in their equivalent www-domains perform HTTPS redirection from HTTPS plain-domains to their equivalent HTTPS www-domains. Additionally, 24.71% of these redirections contains plain-text HTTP intermediate URLs. In these cases, users see the final www-domains with strong TLS configurations and certificates, but in fact, the HTTPS request has passed through plain-domains that have less secure TLS configurations and certificates. Clearly, such a set-up introduces a weak link in the security of the overall interaction. |
| spellingShingle | Alashwali, E Szalachowski, P Martin, A Does "www." mean better transport layer security? |
| title | Does "www." mean better transport layer security? |
| title_full | Does "www." mean better transport layer security? |
| title_fullStr | Does "www." mean better transport layer security? |
| title_full_unstemmed | Does "www." mean better transport layer security? |
| title_short | Does "www." mean better transport layer security? |
| title_sort | does www mean better transport layer security |
| work_keys_str_mv | AT alashwalie doeswwwmeanbettertransportlayersecurity AT szalachowskip doeswwwmeanbettertransportlayersecurity AT martina doeswwwmeanbettertransportlayersecurity |