💾 Archived View for tlsprivacy.nervuri.net captured on 2023-11-14 at 07:26:48. Gemini links have been rewritten to link to archived content
⬅️ Previous capture (2023-11-04)
-=-=-=-=-=-=-
This service presents your browser's TLS Client Hello message in multiple formats. It can be used directly or in CI tests to check for TLS privacy pitfalls (session resumption, fingerprinting, system time exposure) and security shortcomings (deprecated TLS versions, weak cipher suites, missing features, etc).
TLS session resumption marginally speeds up the initiation of connections, but it affects privacy in much the same way that HTTP cookies do: the server provides a unique token that your browser sends back on subsequent connections, allowing the server to link your visits even if your IP address changes. The browser can mitigate this by enforcing a short TLS session lifetime: the paper linked below suggests a limit of 10 minutes or less.
Tracking Users across the Web via TLS Session Resumption
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (not recommended)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (not recommended)
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (not recommended)
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (not recommended)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (not recommended)
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (not recommended)
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (not recommended)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (not recommended)
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (not recommended)
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (not recommended)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (not recommended)
TLS_DHE_RSA_WITH_AES_128_CBC_SHA (not recommended)
TLS_RSA_WITH_AES_256_GCM_SHA384 (not recommended)
TLS_RSA_WITH_AES_128_GCM_SHA256 (not recommended)
TLS_RSA_WITH_AES_256_CBC_SHA256 (not recommended)
TLS_RSA_WITH_AES_128_CBC_SHA256 (not recommended)
TLS_RSA_WITH_AES_256_CBC_SHA (not recommended)
TLS_RSA_WITH_AES_128_CBC_SHA (not recommended)
TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Parameters in the Client Hello message differ between clients, enabling servers and on-path observers to detect what browser you are likely using (down to its version, or a range of versions) by deriving its fingerprint from said parameters. Worse, if you change any TLS-related settings, your TLS fingerprint becomes specific to a much smaller group of users, possibly even to you alone.
JA3 is a simple and popular type of TLS fingerprint. NJA3 is a similar style of fingerprint which aims to improve the robustness and accuracy of JA3.
TLS Fingerprinting with JA3 and JA3S
_____________________