• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>Proceedings of the 1st Network Traffic Measurement and Analysis Conference >Push away your privacy: Precise user tracking based on TLS client certificate authentication
【24h】

Push away your privacy: Precise user tracking based on TLS client certificate authentication

机译：消除隐私：基于TLS客户端证书身份验证的精确用户跟踪

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

The design and implementation of cryptographic systems offer many subtle pitfalls. One such pitfall is that cryptography may create unique identifiers potentially usable to repeatedly and precisely re-identify and hence track users. This work investigates TLS Client Certificate Authentication (CCA), which currently transmits certificates in plain text. We demonstrate CCA's impact on client traceability using Apple's Apple Push Notification service (APNs) as an example. APNs is used by all Apple products, employs plain-text CCA, and aims to be constantly connected to its backend. Its novel combination of large device count, constant connections, device proximity to users and unique client certificates provides for precise client traceability. We show that passive eavesdropping allows to precisely re-identify and track users and that only ten interception points are required to track more than 80 percent of APNs users due to global routing characteristics. We conduct our work under strong ethical guidelines, responsibly disclose our findings, and can confirm a working patch by Apple for the highlighted issue. We aim for this work to provide the necessary factual and quantified evidence about negative implications of plain-text CCA to boost deployment of encrypted CCA as in TLS 1.3.
机译：密码系统的设计和实现提供了许多细微的陷阱。这样的陷阱之一是，加密技术可能会创建唯一的标识符，这些标识符可能可用于重复，精确地重新标识并跟踪用户。这项工作研究TLS客户端证书认证（CCA），该客户端当前以纯文本格式传输证书。我们以Apple的Apple Push Notification Service（APN）为例，说明CCA对客户端可追溯性的影响。苹果公司的所有产品都使用APN，并采用纯文本CCA，并致力于与后端不断连接。它将大量设备，恒定连接，靠近用户的设备以及独特的客户端证书的新颖组合提供了精确的客户端可追溯性。我们显示，被动窃听可以精确地重新识别和跟踪用户，并且由于具有全局路由特性，只需要十个拦截点即可跟踪80％以上的APNs用户。我们在严格的道德准则下进行工作，负责任地披露我们的发现，并可以确认Apple针对突出显示的问题进行了有效的修补。我们的目标是为这项工作提供必要的事实和量化证据，以证明纯文本CCA的负面影响，以促进TLS 1.3中加密CCA的部署。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号