Analyzing the Browser Security Warnings on HTTPS Errors

Congli Wang; Jingqiang Lin; Bingyu Li; Qi Li; Qiongxiao Wang; Xiaokun Zhang

doi:10.1109/ICC.2019.8761629

Analyzing the Browser Security Warnings on HTTPS Errors

Congli Wang
, Jingqiang Lin^*
, Bingyu Li
, Qi Li
, Qiongxiao Wang
, Xiaokun Zhang

^*Corresponding author for this work

CAS - Institute of Information Engineering
Chinese Academy of Sciences
University of Chinese Academy of Sciences
Tsinghua University
CAS - Academy of Opto-Electronics

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

2 Scopus citations

Abstract

HTTPS provides authentication, data confidentiality, and integrity for secure web applications in the Internet. In order to establish secure connections with the target website but not a man-in-the-middle or impersonation attacker, a browser shows security warnings to users, when different HTTPS errors happen (e.g., it fails to build a valid certificate chain, or the certificate subject does not match the domain visited). Each browser implements its own design of warnings on HTTPS errors, to balance security and usability. This paper presents a list of common HTTPS errors, and we investigate the browser behaviors on each error. Our study discloses browser defects on handling HTTPS errors in terms of cryptographic algorithm, certificate verification, name validation, HPKP, and HSTS.

Original language	English
Title of host publication	2019 IEEE International Conference on Communications, ICC 2019 - Proceedings
Publisher	Institute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)	9781538680889
DOIs	https://doi.org/10.1109/ICC.2019.8761629
State	Published - May 2019
Externally published	Yes
Event	2019 IEEE International Conference on Communications, ICC 2019 - Shanghai, China Duration: 20 May 2019 → 24 May 2019

Publication series

Name	IEEE International Conference on Communications
Volume	2019-May
ISSN (Print)	1550-3607

Conference

Conference	2019 IEEE International Conference on Communications, ICC 2019
Country/Territory	China
City	Shanghai
Period	20/05/19 → 24/05/19

Keywords

Browser security
Certificate
HTTPS
Warning

Access to Document

10.1109/ICC.2019.8761629

Cite this

Wang, C., Lin, J., Li, B., Li, Q., Wang, Q., & Zhang, X. (2019). Analyzing the Browser Security Warnings on HTTPS Errors. In 2019 IEEE International Conference on Communications, ICC 2019 - Proceedings Article 8761629 (IEEE International Conference on Communications; Vol. 2019-May). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/ICC.2019.8761629

@inproceedings{1835553b0b0741b2996bee8eebad0202,

title = "Analyzing the Browser Security Warnings on HTTPS Errors",

abstract = "HTTPS provides authentication, data confidentiality, and integrity for secure web applications in the Internet. In order to establish secure connections with the target website but not a man-in-the-middle or impersonation attacker, a browser shows security warnings to users, when different HTTPS errors happen (e.g., it fails to build a valid certificate chain, or the certificate subject does not match the domain visited). Each browser implements its own design of warnings on HTTPS errors, to balance security and usability. This paper presents a list of common HTTPS errors, and we investigate the browser behaviors on each error. Our study discloses browser defects on handling HTTPS errors in terms of cryptographic algorithm, certificate verification, name validation, HPKP, and HSTS.",

keywords = "Browser security, Certificate, HTTPS, Warning",

author = "Congli Wang and Jingqiang Lin and Bingyu Li and Qi Li and Qiongxiao Wang and Xiaokun Zhang",

note = "Publisher Copyright: {\textcopyright} 2019 IEEE.; 2019 IEEE International Conference on Communications, ICC 2019 ; Conference date: 20-05-2019 Through 24-05-2019",

year = "2019",

month = may,

doi = "10.1109/ICC.2019.8761629",

language = "英语",

series = "IEEE International Conference on Communications",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

booktitle = "2019 IEEE International Conference on Communications, ICC 2019 - Proceedings",

address = "美国",

}

Wang, C, Lin, J, Li, B, Li, Q, Wang, Q & Zhang, X 2019, Analyzing the Browser Security Warnings on HTTPS Errors. in 2019 IEEE International Conference on Communications, ICC 2019 - Proceedings., 8761629, IEEE International Conference on Communications, vol. 2019-May, Institute of Electrical and Electronics Engineers Inc., 2019 IEEE International Conference on Communications, ICC 2019, Shanghai, China, 20/05/19. https://doi.org/10.1109/ICC.2019.8761629

Analyzing the Browser Security Warnings on HTTPS Errors. / Wang, Congli; Lin, Jingqiang; Li, Bingyu et al.
2019 IEEE International Conference on Communications, ICC 2019 - Proceedings. Institute of Electrical and Electronics Engineers Inc., 2019. 8761629 (IEEE International Conference on Communications; Vol. 2019-May).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Analyzing the Browser Security Warnings on HTTPS Errors

AU - Wang, Congli

AU - Lin, Jingqiang

AU - Li, Bingyu

AU - Li, Qi

AU - Wang, Qiongxiao

AU - Zhang, Xiaokun

PY - 2019/5

Y1 - 2019/5

N2 - HTTPS provides authentication, data confidentiality, and integrity for secure web applications in the Internet. In order to establish secure connections with the target website but not a man-in-the-middle or impersonation attacker, a browser shows security warnings to users, when different HTTPS errors happen (e.g., it fails to build a valid certificate chain, or the certificate subject does not match the domain visited). Each browser implements its own design of warnings on HTTPS errors, to balance security and usability. This paper presents a list of common HTTPS errors, and we investigate the browser behaviors on each error. Our study discloses browser defects on handling HTTPS errors in terms of cryptographic algorithm, certificate verification, name validation, HPKP, and HSTS.

AB - HTTPS provides authentication, data confidentiality, and integrity for secure web applications in the Internet. In order to establish secure connections with the target website but not a man-in-the-middle or impersonation attacker, a browser shows security warnings to users, when different HTTPS errors happen (e.g., it fails to build a valid certificate chain, or the certificate subject does not match the domain visited). Each browser implements its own design of warnings on HTTPS errors, to balance security and usability. This paper presents a list of common HTTPS errors, and we investigate the browser behaviors on each error. Our study discloses browser defects on handling HTTPS errors in terms of cryptographic algorithm, certificate verification, name validation, HPKP, and HSTS.

KW - Browser security

KW - Certificate

KW - HTTPS

KW - Warning

UR - https://www.scopus.com/pages/publications/85070194316

U2 - 10.1109/ICC.2019.8761629

DO - 10.1109/ICC.2019.8761629

M3 - 会议稿件

AN - SCOPUS:85070194316

T3 - IEEE International Conference on Communications

BT - 2019 IEEE International Conference on Communications, ICC 2019 - Proceedings

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 2019 IEEE International Conference on Communications, ICC 2019

Y2 - 20 May 2019 through 24 May 2019

ER -

Analyzing the Browser Security Warnings on HTTPS Errors

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this