2017/12/15 (五) 14:20 蕭旭君 教授（台大 資工系）Progress Towards Enhancing HTTPS Adoption on the Web: A Multi-stakeholder Investigation
Topic：Progress Towards Enhancing HTTPS Adoption on the Web: A Multi-stakeholder Investigation
Date&Time：2017/12/15(五) 14:20
Speaker：蕭旭君 教授 (台大資工系 Dept. of Computer Science and Information Engineering, NTU)
Location：清華大學台達館 DELTA @R216
Abstract:
A well-known and recurring Internet security concern is supporting HTTPS for the security, privacy, and integrity of data in end-to-end communications. However, HTTPS adoption rate remains low nowadays and many websites fail to correctly configure HTTPS. Investigating the current security practices is a necessary first step towards an ideal, HTTPS-everywhere Internet. In this talk, I will present two of our recent studies about HTTPS adoption on the web. The first study investigates the impact of URL redirection on HTTPS. Particularly, we examined the integrity and consistency of URL redirections for the Alexa top one million (1M) websites, and further examined 10,000 (10K) websites with their login features. Our results suggest that the majority of redirection trails among websites that support only HTTPS are vulnerable to attacks, and current incoherent practices undermine the security guarantees provided by HTTPS and HSTS. The second study investigates the government's role in the HTTPS ecosystem. We examined HTTPS adoption on G7 and Taiwan government websites, and perform an in-depth case study that involves interviewing government officials and administrators of government websites. Our survey and interview results reveal infrastructural and administrative challenges that government sites may encounter when using HTTPS, including the effectiveness of government mandates, discrepancies between the website owner and creating contractors, and certificate verification issues.
Bio:
Dr. Hsu-Chun Hsiao is an Assistant Professor in the Department of Computer Science and Information Engineering, and the Graduate Institute of Networking and Multimedia at National Taiwan University. She also holds an adjunct assistant researcher position in the Center of Information Technology and Innovation at Academia Sinica. Dr. Hsiao completed her B.S. (2006) and M.S. (2008) at National Taiwan University and Ph.D. at Carnegie Mellon University (2014). Her research interests include network security, anonymity and privacy, and applied cryptography.
Date&Time：2017/12/15(五) 14:20
Speaker：蕭旭君 教授 (台大資工系 Dept. of Computer Science and Information Engineering, NTU)
Location：清華大學台達館 DELTA @R216
Abstract:
A well-known and recurring Internet security concern is supporting HTTPS for the security, privacy, and integrity of data in end-to-end communications. However, HTTPS adoption rate remains low nowadays and many websites fail to correctly configure HTTPS. Investigating the current security practices is a necessary first step towards an ideal, HTTPS-everywhere Internet. In this talk, I will present two of our recent studies about HTTPS adoption on the web. The first study investigates the impact of URL redirection on HTTPS. Particularly, we examined the integrity and consistency of URL redirections for the Alexa top one million (1M) websites, and further examined 10,000 (10K) websites with their login features. Our results suggest that the majority of redirection trails among websites that support only HTTPS are vulnerable to attacks, and current incoherent practices undermine the security guarantees provided by HTTPS and HSTS. The second study investigates the government's role in the HTTPS ecosystem. We examined HTTPS adoption on G7 and Taiwan government websites, and perform an in-depth case study that involves interviewing government officials and administrators of government websites. Our survey and interview results reveal infrastructural and administrative challenges that government sites may encounter when using HTTPS, including the effectiveness of government mandates, discrepancies between the website owner and creating contractors, and certificate verification issues.
Bio:
Dr. Hsu-Chun Hsiao is an Assistant Professor in the Department of Computer Science and Information Engineering, and the Graduate Institute of Networking and Multimedia at National Taiwan University. She also holds an adjunct assistant researcher position in the Center of Information Technology and Innovation at Academia Sinica. Dr. Hsiao completed her B.S. (2006) and M.S. (2008) at National Taiwan University and Ph.D. at Carnegie Mellon University (2014). Her research interests include network security, anonymity and privacy, and applied cryptography.