4 ms·

This is pretty low-tech but I think is pretty effective. https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm

by cascom 7y ago

eikenberry 7y ago
I get matching results for everything but wikipedia. I doubled checked with my VPS and got the same results. Could it be using region based routing to sites with different certs or something?
- pmoriarty 7y ago
  Same here. From the GRC fingerprints page FAQ: "What can go wrong with this test? "There ARE several things to consider: "False-Positive Mismatches: "Smaller web sites, like this one (GRC) and those others listed above, deploy only one security certificate on one or more web servers (For example, our wonderful certificate provider, DigiCert, specifically allows us to use the same single certificate on as many servers as necessary.) "But companies with a massive and widely distributed web presence, such as Amazon or Google, may deploy many different security certificates across their many globally distributed servers and web sites. Multiple certificates may be easier for them to obtain and manage, and their security is not reduced. But it does mean that not every user of their servers (like you and this GRC page) would necessarily obtain the same security certificate. "This means that a simple comparison of certificate fingerprints could erroneously lead people wishing to test these huge websites to conclude that their connections were being intercepted, when they have simply received a different valid certificate than the one received and shown by this web page. "The best solution is to test smaller sites that are known to be using single certificates, or sites using the completely unspoofable extended validation (EV) certificates with an EV-honoring web browser such as Firefox or Chrome (but not Internet Explorer, which doesn't properly verify EV certificates)."
jf- 7y ago
Would these be expected to change by country? I’m getting different results from grc for Facebook, Wikipedia and others in the UK, but the results are consistent between different connections. Results match for grc and paypal.
- swalls 7y ago
  Also in the UK (ISP is Virgin), getting similar results: the extended validation ones are the matching but the rest aren't.

This is pretty low-tech but I think is pretty effective. https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm

by cascom 7y ago

This is pretty low-tech but I think is pretty effective. https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm

eikenberry 7y ago

I get matching results for everything but wikipedia. I doubled checked with my VPS and got the same results. Could it be using region based routing to sites with different certs or something?

pmoriarty 7y ago
Same here. From the GRC fingerprints page FAQ: "What can go wrong with this test? "There ARE several things to consider: "False-Positive Mismatches: "Smaller web sites, like this one (GRC) and those others listed above, deploy only one security certificate on one or more web servers (For example, our wonderful certificate provider, DigiCert, specifically allows us to use the same single certificate on as many servers as necessary.) "But companies with a massive and widely distributed web presence, such as Amazon or Google, may deploy many different security certificates across their many globally distributed servers and web sites. Multiple certificates may be easier for them to obtain and manage, and their security is not reduced. But it does mean that not every user of their servers (like you and this GRC page) would necessarily obtain the same security certificate. "This means that a simple comparison of certificate fingerprints could erroneously lead people wishing to test these huge websites to conclude that their connections were being intercepted, when they have simply received a different valid certificate than the one received and shown by this web page. "The best solution is to test smaller sites that are known to be using single certificates, or sites using the completely unspoofable extended validation (EV) certificates with an EV-honoring web browser such as Firefox or Chrome (but not Internet Explorer, which doesn't properly verify EV certificates)."

jf- 7y ago

Would these be expected to change by country? I’m getting different results from grc for Facebook, Wikipedia and others in the UK, but the results are consistent between different connections. Results match for grc and paypal.

swalls 7y ago
Also in the UK (ISP is Virgin), getting similar results: the extended validation ones are the matching but the rest aren't.