论文部分内容阅读
在不使用中间人攻击的情况下(伪造证书),HTTPS是比较安全的(sslv3防范了中间人攻击)。但是,即使恶意代理无法直接读到HTTPS加密过后的明文,但是攻击者还是可以使用一些攻击的技巧来达到目的。这就是PBP-因浏览器的缺陷引起的代理攻击。本文说明了目前使用的代理机制上存在的威胁并阐述了这些威胁实现攻击的几种方法,并对于一些没有对浏览器及时更新或对没有好好管理所在局域网的代理的用户提出了警告,提醒在校学生在使用代理(所谓的加速器)上网时有可能存在的安全隐患。
HTTPS is safer without using man-in-the-middle attacks (fake certificates) (sslv3 prevents man-in-the-middle attacks). However, even if the malicious agent can not directly read the plaintext after HTTPS encryption, attackers can still use some attacking techniques to achieve their goals. This is the PBP-proxy attack due to browser flaws. This article explains the current threat mechanisms on the proxy mechanism and describes several ways in which these threats can be exploited. It also warns users who do not have timely updates to the browser or proxies that do not properly manage their LANs, School students may experience security risks when using proxies (so-called accelerators) to surf the Net.