Quantifying User Password Exposure to Third-Party CDNs
share
Web services commonly employ Content Distribution Networks (CDNs) for performance and security. As web traffic is becoming 100 websites allow CDNs to terminate their HTTPS connections. This practice may expose a website's user sensitive information such as a user's login password to a third-party CDN. In this paper, we measure and quantify the extent of user password exposure to third-party CDNs. We find that among Alexa top 50K websites, at least 12,451 of them use CDNs and contain user login entrances. Among those websites, 33 popular CDN may observe passwords from more than 40 result suggests that if a CDN infrastructure has a vulnerability or an insider attack, many users' accounts will be at risk. If we assume the attacker is a passive eavesdropper, a website can avoid this vulnerability by encrypting users' passwords in HTTPS connections. Our measurement shows that less than 17 of the websites adopt this countermeasure.
READ FULL TEXT