NoahWatson
Well-Known Member
- 1 297
- 3 205
Okazuje się, że jeśli odwiedza się witrynę za pomocą https, którą przeanalizowali matematycy, to Ci matematycy są w stanie w 89% przypadków rozpoznać którą podstronę się odwiedzało/jaki rodzaj danych się przesłało. Innymi słowy matematycy nie znaleźli metody rozszyfrowania https, ale są w stanie analizować szyfrowany ruch sieciowy.
http://it.slashdot.org/story/14/03/...le-to-traffic-analysis-attacks-than-suspected
http://it.slashdot.org/story/14/03/...le-to-traffic-analysis-attacks-than-suspected
"Researchers have built new attack techniques against HTTPS traffic that have been effective in learning details on users' surfing habits, leaking sensitive data that could impact privacy. They tested against 600 leading healthcare, finance, legal services and streaming video sites, including Netflix. Their attack, they said in a research paper, reduced errors from previous methodologies more than 3 ½ times. They also demonstrate a defense against this attack that reduces the accuracy of attacks by 27 percent by increasing the effectiveness of packet level defenses in HTTPS, the paper said. 'We design our attack to distinguish minor variations in HTTPS traffic from significant variations which indicate distinct traffic contents,' the paper said. 'Minor traffic variations may be caused by caching, dynamically generated content, or user-specific content including cookies. Our attack applies clustering techniques to identify patterns in traffic.'"