4 ms·

Could https be used to track persons on the internet using some phase of the protocol? Perhaps the "random" number generated after a handshake is not so random

Could https be used to track persons on the internet using some phase of the protocol? Perhaps the "random" number generated after a handshake is not so random and actually identifies you as a user? Sure, your communications are encrypted by what people perceive as an infallible algorithm, and all serious websites with forms force you to use it, but at what cost?

zaarn 9y ago
> Perhaps the "random" number generated after a handshake is not so random and actually identifies you as a user? If the RNG isn't random then the protocol just broke and HTTPS turns into paperweight. You usually get tracked by your browser and remote IP much easier than tracking details in the TLS connection.
quickthrower2 9y ago
What about a session cookie?
- nurettin 9y ago
  It is obviously very easy to evade cookies and IP tracking, so I'm not even sure why these are suggested. However, if the https protocol itself is bugged at the TLS level, what can you do? What if the last few bytes of the ssl session number are always generated according to your unique hardware specs? What then? I'm aware that this looks a lot like FUD, but it is rather a question, because I'm not peddling an alternative. Why implicitly trust any protocol?
tialaramex 9y ago
I _think_ the number you're talking about is the session key. The session key is agreed by both parties. Key Agreement is actually some pretty clever mathematics, but it goes like this (except the real numbers are enormous and I've used small ones): You: "Let's pick a session key, let's use method A, with the magic numbers 15 and 29. I chose my random number, and with A, 15 and 29 the answer was 4." www.google.com: "Cool yes, method A with numbers 15 and 29 is fine by me. I picked a random number and my answer was 3." Now both you and Google can determine that the secret session key is 9, because each of you knows _your_ secret random number and the number the other person got by using _their_ secret random number with the special method. But even if the other person lied and always picks the same number, the _result_ is random, because you did you part of the trick properly. Nobody else knows it's 9, even if they eavesdropped on this conversation taking place, because they need one of the secret random numbers to work it out OR they need to solve a mind-bogglingly hard mathematical problem to get the answer without knowing the secret.

zaarn 9y ago

> Perhaps the "random" number generated after a handshake is not so random and actually identifies you as a user? If the RNG isn't random then the protocol just broke and HTTPS turns into paperweight. You usually get tracked by your browser and remote IP much easier than tracking details in the TLS connection.

quickthrower2 9y ago

What about a session cookie?

nurettin 9y ago
It is obviously very easy to evade cookies and IP tracking, so I'm not even sure why these are suggested. However, if the https protocol itself is bugged at the TLS level, what can you do? What if the last few bytes of the ssl session number are always generated according to your unique hardware specs? What then? I'm aware that this looks a lot like FUD, but it is rather a question, because I'm not peddling an alternative. Why implicitly trust any protocol?

tialaramex 9y ago

I _think_ the number you're talking about is the session key. The session key is agreed by both parties. Key Agreement is actually some pretty clever mathematics, but it goes like this (except the real numbers are enormous and I've used small ones): You: "Let's pick a session key, let's use method A, with the magic numbers 15 and 29. I chose my random number, and with A, 15 and 29 the answer was 4." www.google.com: "Cool yes, method A with numbers 15 and 29 is fine by me. I picked a random number and my answer was 3." Now both you and Google can determine that the secret session key is 9, because each of you knows _your_ secret random number and the number the other person got by using _their_ secret random number with the special method. But even if the other person lied and always picks the same number, the _result_ is random, because you did you part of the trick properly. Nobody else knows it's 9, even if they eavesdropped on this conversation taking place, because they need one of the secret random numbers to work it out OR they need to solve a mind-bogglingly hard mathematical problem to get the answer without knowing the secret.