Dergiler / International Journal of Information Security Science / 2016 / Cilt: 5 - Sayı: 2

Customizing SSL Certificate Extensions to Reduce False-Positive Certificate Error/Warning Messages

Sayfa
21–28
Yayın Tarihi
2016-06-01
DOI
—
🏛️Bu makalenin bibliyografik verileri ve tam metin bağlantısı DergiPark üzerinden sağlanmıştır.
DergiPark Kaydı ↗
✨

Yapay Zeka Hızlı Bakış & Çıkarımlar

AI Insight
⚡ TL;DR(1 Cümlede Hızlı Çıkarım)

In this study, with the importance of user’s daily practices in developing habits in mind, we studied a modification of X.509 certificates in order to reduce the number of false-positive certificate-warning pop ups in order to reduce gaining faulty usage habit of invalid certificates.

📌 3 Maddede Bu Makale

🎯
Amaç & Hipotez:In todays Internet world, X.509 certificates are commonly used in SSL protocol to provide security for web-based services by server/client authentication and secure communication.
📊
Temel Bulgular & Veri:There are significant number of scientific studies in the literature reporting that the count of invalid or self-signed certificate usage in today’s Internet can not be overlooked.
💡
Sonuç & Katkı:In this study, with the importance of user’s daily practices in developing habits in mind, we studied a modification of X.509 certificates in order to reduce the number of false-positive certificate-warning pop ups in order to reduce gaining faulty usage habit of invalid certificates.
🔬Tür:Araştırma Makalesi
📍Kapsam:Genişletilmiş Akademik Örneklem
⚙️Değişkenler:X509 certificates · SSL protocol · certificate extensions

Abstract

In todays Internet world, X.509 certificates are commonly used in SSL protocol to provide security for web-based services by server/client authentication and secure communication. Although SSL protocol presents a technical basis, this web-security largely depends on user awareness of security measures as well. There are significant number of scientific studies in the literature reporting that the count of invalid or self-signed certificate usage in today’s Internet can not be overlooked. At the same time, quite a number of studies place emphasis on the acquired indifference towards certificate warning messages which are popped up by web browsers when visiting web pages with invalid or self-signed certificates. In this study, with the importance of user’s daily practices in developing habits in mind, we studied a modification of X.509 certificates in order to reduce the number of false-positive certificate-warning pop ups in order to reduce gaining faulty usage habit of invalid certificates.

🔖

Bu Makaleye Atıf Yap

TARAZAN, Ş., BOSTAN, A. (2016). Customizing SSL Certificate Extensions to Reduce False-Positive Certificate Error/Warning Messages. International Journal of Information Security Science, Cilt: 5 - Sayı: 2, 21–28. https://ajindex.com/articles/833047

📄 Tam Metin PDF Okuyucu

📄

PDF görüntüleyici hazırlanıyor...

Kaynakça (6)

  1. T. Dierks, The transport layer security (TLS) protocol version 1.2, IETF RFC-5246, 2008, Available online at https://tools.ietf.org/html/rfc5246. K. Paterson and M. Albrecht, “Lucky Microseconds: A Timing Attack on Amazon's s2n Implementation of TLS”, Real World Cryptography Conference 2016, 6-8 January 2016,
  2. Stanford, CA, USA. V. K. Keerthi, “Taxonomy of SSL/TLS Attacks.”, International Journal of Computer Network and Information Security, Vol.8 No 2, Feb. 2016
  3. X. D. C. de Carnavalet and Mannan, M., “Killed by Proxy: Software.”, Cocordia university publications, 2016, http://users.encs.concordia.ca/~mmannan/publications/s sl-interception-ndss2016.pdf, Latest Access Time for the website is 23 April 2016.
  4. TLS Interception V. S Subrahmanian, M. Ovelgonne, T. Dumitras and A. Prakash, The Global Cyber-Vulnerability Report., ISBN: 978-3-319-25758-7, 2016. CSI 2010-2011, 15th Annual CSI Computer Crime & Security Survey, Computer Security Institute, 2011, http://reports.informationweek.com/cart/index/downloa dlink/id/7377, Latest Access Time for the website is 12 December 2013. CSI 2009, 14th Annual CSI Computer Crime & Security Survey, Comprehensive Addition, Computer Security http://gocsi.com/purchase_survey, Latest Access Time for the website is 11 June 2011. 2009, CSI 2008, CSI Computer Crime & Security Survey (2008), http://gocsi.com/sites/default/files/uploads/CSIsurvey20 08.pdf, Latest Access Time for the website is 12 December 2013.
  5. Security Institute, P. Kamal, “State of the Art Survey on Session Hijacking.”, Global Journal of Computer Science and Technology, Vol.15, No.1, 2016 [10] J. D’Arcy and A.Hovav, “Deterring Internal Information Misuse”, Communications of the ACM, Vol.50 No.10, pp 113-117, October 2007 Kevin Palfreyman and Tom Rodden, “A Protocol for User Awareness And World Wide Web”, Proceedings of Cambridge MA, USA,1996, ACM 0-89791-765- 0/96/11 Cooperative Work’96, B. Gross Joshua and B. Rosson Mary, “Looking for Trouble: Management”, Computer Human Interaction for Management of IT (CHIMIT’07), Cambridge MA. USA., 30-31 March 2007, ACM 1-59593-635- 6/97/0003 End-User Security M. Evans, L. A. Maglaras, Y. He and H. Janicke, “Human Behaviour as an aspect of Cyber Security Assurance.”, arXiv preprint arXiv:1601.03921, 2016 Hugo Krawczyk and Hoeteck Wee, “The OPTLS Protocol and TLS 1.3”, Real World Cryptography Conference 2016, 6-8 January 2016,
  6. Stanford, CA, USA. Adrienne Porter Felt, “Where the Wild Warnings Are: The TLS Story”, Real World Cryp