From Wikipedia, the free encyclopedia

The Internet Portal

Internet Archive servers

An Internet kiosk

The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a network of networks that consists of private, public, academic, business, and government networks of local to global scope, linked by a broad array of electronic, wireless, and optical networking technologies. The Internet carries a vast range of information resources and services, such as the interlinked hypertext documents and applications of the World Wide Web (WWW), electronic mail, telephony, and file sharing.

The origins of the Internet date back to the development of packet switching and research commissioned by the United States Department of Defense in the late 1960s to enable time-sharing of computers. The primary precursor network, the ARPANET, initially served as a backbone for the interconnection of regional academic and military networks in the 1970s to enable resource sharing. The funding of the National Science Foundation Network as a new backbone in the 1980s, as well as private funding for other commercial extensions, led to worldwide participation in the development of new networking technologies, and the merger of many networks. The linking of commercial networks and enterprises by the early 1990s marked the beginning of the transition to the modern Internet, and generated a sustained exponential growth as generations of institutional, personal, and mobile computers were connected to the network. Although the Internet was widely used by academia in the 1980s, commercialization incorporated its services and technologies into virtually every aspect of modern life. (Full article...)

Selected article

Screenshot of ScienTOMogy from November 2005
ScienTOMogy was a parody web site lampooning Tom Cruise's involvement with Scientology, initially hosted at the domain name scientomogy.info. The site was created in 2005 after increased media publicity surrounding Cruise's appearances on The Oprah Winfrey Show and The Today Show. ScienTOMogy gained press attention after it was contacted by the Church of Scientology with a cease and desist letter, alleging copyright infringement over use of the word "Scientomogy", claiming that it was too close to the word "Scientology". The proprietor of the site initially agreed to relent to the Church's demands, but after consulting attorneys, instead decided to keep the site. Internet traffic to the site later increased dramatically as a result of the media and press attention surrounding the Church of Scientology's alleged copyright infringement claims.

Selected picture

Tech. Sgt. Troy Goodman watches the newest member of his family via webcam
Credit: United States Air Force, Master Sergeant Sean Brennan

Webcams are small cameras, (usually, though not always, video cameras) whose images can be accessed using the World Wide Web, instant messaging, or a PC video conferencing application. The term webcam is also used to describe the low-resolution digital video cameras designed for such purposes, but which can also be used to record in a non-real-time fashion.


Wikinews Internet portal
Read and edit Wikinews



Did you know (auto-generated) - load new batch

Nuvola apps filetypes.svg
  • ... that David Bowie's 1999 album Hours was the first by a major artist available for download from the Internet?
  • ... that Meme Man is used in many surreal memes, a genre of internet humor inspired by surrealism?
  • ... that Joanna Cherry showed a printed copy of an Internet meme featuring Lily Hoshikawa during a UK parliamentary committee meeting?
  • ... that Internet activist Sally Burch was refused entry into Argentina because her presence was considered to be disruptive?
  • ... that the music minister, seminary student, and pageant contestant Leah Boyd became an Internet celebrity due to her comedic and satirical commentary on Twitter?
  • ... that the Backrooms is associated with an Internet aesthetic which includes images of eerie and uninhabited spaces?

Selected biography

Barry Diller in 2005
Barry Diller (born February 2, 1942 in San Francisco, California) is media executive responsible for the creation of Fox Broadcasting Company. Diller is currently the Chairman of Expedia and the Chairman and Chief Executive Officer of IAC/InterActiveCorp, an interactive commerce conglomerate and the parent of companies including ServiceMagic, Home Shopping Network, Ticketmaster, Match.com, Citysearch, LendingTree and CollegeHumor. In 2005, IAC/InterActiveCorp acquired Ask.com, marking a strategic move into the Internet search category. Diller has been on the board of The Coca-Cola Company since 2002. The new headquarters of IAC/InterActiveCorp was designed by Frank Gehry and opened in 2007 at 18th Street and the West Side Highway in Manhattan's Chelsea neighborhood. The western half of the block is dedicated to the building which stands several stories taller than the massive Chelsea Piers Sporting complex just across the West Side Highway. The extra floors guarantee a panoramic Hudson River view from Diller's top-floor office.

General images - load new batch

The following are images from various internet-related articles on Wikipedia.

Selected quote

Representative Tom Lantos
China has placed severe restrictions on the Internet and enlisted America's high-tech companies as their Internet police.... As we meet today, Chinese citizens who had the courage to speak their minds on the Internet are in the Chinese gulag because Yahoo chose to reveal their identities to the Chinese government.

More Did you know...

J. Michael Straczynski

Main topics

HTTP Strict Transport Security (HSTS) is a policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks[1] and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should automatically interact with it using only HTTPS connections, which provide Transport Layer Security (TLS/SSL), unlike the insecure HTTP used alone. HSTS is an IETF standards track protocol and is specified in RFC 6797.

The HSTS Policy is communicated by the server to the user agent via an HTTP response header field named "Strict-Transport-Security". HSTS Policy specifies a period of time during which the user agent should only access the server in a secure fashion.[2] Websites using HSTS often do not accept clear text HTTP, either by rejecting connections over HTTP or systematically redirecting users to HTTPS (though this is not required by the specification). The consequence of this is that a user-agent not capable of doing TLS will not be able to connect to the site.

The protection only applies after a user has visited the site at least once, relying on the principle of "trust on first use". The way this protection works is that a user entering or selecting a URL to the site that specifies HTTP, will automatically upgrade to HTTPS, without making an HTTP request, which prevents the HTTP man-in-the-middle attack from occurring.

Specification history

The HSTS specification was published as RFC 6797 on 19 November 2012 after being approved on 2 October 2012 by the IESG for publication as a Proposed Standard RFC.[3] The authors originally submitted it as an Internet Draft on 17 June 2010. With the conversion to an Internet Draft, the specification name was altered from "Strict Transport Security" (STS) to "HTTP Strict Transport Security", because the specification applies only to HTTP.[4] The HTTP response header field defined in the HSTS specification however remains named "Strict-Transport-Security".

The last so-called "community version" of the then-named "STS" specification was published on 18 December 2009, with revisions based on community feedback.[5]

The original draft specification by Jeff Hodges from PayPal, Collin Jackson, and Adam Barth was published on 18 September 2009.[6]

The HSTS specification is based on original work by Jackson and Barth as described in their paper "ForceHTTPS: Protecting High-Security Web Sites from Network Attacks".[7]

Additionally, HSTS is the realization of one facet of an overall vision for improving web security, put forward by Jeff Hodges and Andy Steingruebl in their 2010 paper The Need for Coherent Web Security Policy Framework(s).[8]

HSTS mechanism overview

A server implements an HSTS policy by supplying a header over an HTTPS connection (HSTS headers over HTTP are ignored).[1] For example, a server could send a header such that future requests to the domain for the next year (max-age is specified in seconds; 31,536,000 is equal to one non-leap year) use only HTTPS: Strict-Transport-Security: max-age=31536000.

When a web application issues HSTS Policy to user agents, conformant user agents behave as follows (RFC 6797):[9]

  1. Automatically turn any insecure links referencing the web application into secure links (e.g. http://example.com/some/page/ will be modified to https://example.com/some/page/ before accessing the server).
  2. If the security of the connection cannot be ensured (e.g. the server's TLS certificate is not trusted), the user agent must terminate the connection (RFC 6797 section 8.4, Errors in Secure Transport Establishment) and should not allow the user to access the web application (section 12.1, No User Recourse).

The HSTS Policy helps protect web application users against some passive (eavesdropping) and active network attacks.[10] A man-in-the-middle attacker has a greatly reduced ability to intercept requests and responses between a user and a web application server while the user's browser has HSTS Policy in effect for that web application.


The most important security vulnerability that HSTS can fix is SSL-stripping man-in-the-middle attacks, first publicly introduced by Moxie Marlinspike in his 2009 BlackHat Federal talk "New Tricks For Defeating SSL In Practice".[11][12] The SSL (and TLS) stripping attack works by transparently converting a secure HTTPS connection into a plain HTTP connection. The user can see that the connection is insecure, but crucially there is no way of knowing whether the connection should be secure. At the time of Marlinspike's talk, many websites did not use TLS/SSL, therefore there was no way of knowing (without prior knowledge) whether the use of plain HTTP was due to an attack, or simply because the website had not implemented TLS/SSL. Additionally, no warnings are presented to the user during the downgrade process, making the attack fairly subtle to all but the most vigilant. Marlinspike's sslstrip tool fully automates the attack.[citation needed]

HSTS addresses this problem[10] by informing the browser that connections to the site should always use TLS/SSL. The HSTS header can be stripped by the attacker if this is the user's first visit. Google Chrome, Mozilla Firefox, Internet Explorer and Microsoft Edge attempt to limit this problem by including a "pre-loaded" list of HSTS sites.[13][14][15] Unfortunately this solution cannot scale to include all websites on the internet. See limitations, below.

HSTS can also help to prevent having one's cookie-based website login credentials stolen by widely available tools such as Firesheep.[16]

Because HSTS is time limited, it is sensitive to attacks involving shifting the victim's computer time e.g. using false NTP packets.[17]


The initial request remains unprotected from active attacks if it uses an insecure protocol such as plain HTTP or if the URI for the initial request was obtained over an insecure channel.[18] The same applies to the first request after the activity period specified in the advertised HSTS Policy max-age (sites should set a period of several days or months depending on user activity and behavior). Google Chrome, Mozilla Firefox and Internet Explorer/Microsoft Edge address this limitation by implementing a "HSTS preloaded list", which is a list that contains known sites supporting HSTS.[19][13][14][15] This list is distributed with the browser so that it uses HTTPS for the initial request to the listed sites as well. As previously mentioned, these pre-loaded lists cannot scale to cover the entire Web. A potential solution might be achieved by using DNS records to declare HSTS Policy, and accessing them securely via DNSSEC, optionally with certificate fingerprints to ensure validity (which requires running a validating resolver to avoid last mile issues).[20]

Junade Ali has noted that HSTS is ineffective against the use of phony domains; by using DNS-based attacks, it is possible for a man-in-the-middle interceptor to serve traffic from an artificial domain which is not on the HSTS Preload list,[21] this can be made possible by DNS Spoofing Attacks,[22] or simply a domain name that misleadingly resembles the real domain name such as www.example.org instead of www.example.com.

Even with an HSTS preloaded list, HSTS cannot prevent advanced attacks against TLS itself, such as the BEAST or CRIME attacks introduced by Juliano Rizzo and Thai Duong. Attacks against TLS itself are orthogonal to HSTS policy enforcement. Neither can it protect against attacks on the server - if someone compromises it, it will happily serve any content over TLS.

See RFC 6797 for a discussion of overall HSTS security considerations.

Privacy issues

HSTS can be used to near-indelibly tag visiting browsers with recoverable identifying data (supercookies) which can persist in and out of browser "incognito" privacy modes. By creating a web page that makes multiple HTTP requests to selected domains, for example, if twenty browser requests to twenty different domains are used, theoretically over one million visitors can be distinguished (220) due to the resulting requests arriving via HTTP vs. HTTPS; the latter being the previously recorded binary "bits" established earlier via HSTS headers.[23]

Browser support

Settings page Security within Chromium 45, showing the status of the security policy for the domain "en.wikipedia.org".

Deployment best practices

Depending on the actual deployment there are certain threats (e.g. cookie injection attacks) that can be avoided by following best practices.

  • HSTS hosts should declare HSTS policy at their top-level domain name. For example, an HSTS host at https://sub.example.com should also answer with the HSTS header at https://example.com. The header should specify the includeSubDomains directive.[31]
  • In addition to HSTS deployment, a host for https://www.example.com should include a request to a resource from https://example.com to make sure that HSTS for the parent domain is set and protects the user from potential cookie injection attacks performed by a MITM that would inject a reference to the parent domain (or even http://nonexistentpeer.example.com), which the attacker then would answer.[32]

See also


  1. ^ a b c "Strict-Transport-Security". MDN Web Docs. Mozilla. Archived from the original on 20 March 2020. Retrieved 31 January 2018.
  2. ^ Hodges, Jeff; Jackson, Collin; Barth, Adam (November 2012). "HSTS Policy". HTTP Strict Transport Security (HSTS). IETF. sec. 5.2. doi:10.17487/RFC6797. RFC 6797.
  3. ^ "[websec] Protocol Action: 'HTTP Strict Transport Security (HSTS)' to Proposed Standard (draft-ietf-websec-strict-transport-sec-14.txt)". 2 Oct 2012. Archived from the original on 29 January 2017. Retrieved 2 Oct 2012.
  4. ^ Jeff Hodges (30 June 2010). "Re: [HASMAT] "STS" moniker (was: IETF BoF @IETF-78 Maastricht: HASMAT...)". Archived from the original on 2 February 2017. Retrieved 22 July 2010.
  5. ^ "Strict Transport Security -06". 18 December 2009. Archived from the original on 21 February 2017. Retrieved 23 December 2009.
  6. ^ "Strict Transport Security -05". 18 September 2009. Archived from the original on 24 February 2020. Retrieved 19 November 2009.
  7. ^ "ForceHTTPS: Protecting High-Security Web Site from Network Attacks". April 2008. Archived from the original on 28 February 2020. Retrieved 19 November 2009.
  8. ^ Hodges, Jeff; Steinguebl, Andy (29 October 2010). "The Need for Coherent Web Security Policy Framework(s)". Archived from the original on 14 August 2017. Retrieved 21 November 2012.
  9. ^ Hodges, Jeff; Jackson, Collin; Barth, Adam (November 2012). Section 5. HSTS Mechanism Overview. IETF. sec. 5. doi:10.17487/RFC6797. RFC 6797.
  10. ^ a b Hodges, Jeff; Jackson, Collin; Barth, Adam (November 2012). 2.4. Threat Model. IETF. sec. 2.3. doi:10.17487/RFC6797. RFC 6797.
  11. ^ Marlinspike, Moxie (2009). New Tricks For Defeating SSL In Practice (PDF). Black Hat Briefings. Washington, DC. Archived (PDF) from the original on 30 December 2014. Retrieved 15 March 2012.
  12. ^ Defeating SSL Using Sslstrip on YouTube
  13. ^ a b Adam Langley (8 July 2010). "Strict Transport Security". The Chromium Projects. Archived from the original on 1 September 2019. Retrieved 22 July 2010.
  14. ^ a b c David Keeler (1 November 2012). "Preloading HSTS". Mozilla Security Blog. Archived from the original on 24 February 2020. Retrieved 6 February 2014.
  15. ^ a b Bell, Mike; Walp, David (16 February 2015). "HTTP Strict Transport Security comes to Internet Explorer". Archived from the original on 15 November 2015. Retrieved 16 February 2015.
  16. ^ Jeff Hodges (31 October 2010). "Firesheep and HSTS (HTTP Strict Transport Security)". Archived from the original on 23 June 2016. Retrieved 8 Mar 2011.
  17. ^ Selvi, Jose (2014-10-17). Bypassing HTTP Strict Transport Security (PDF). Black Hat Briefings. Amsterdam. Archived (PDF) from the original on 22 October 2014. Retrieved 2014-10-22.
  18. ^ Hodges, Jeff; Jackson, Collin; Barth, Adam (November 2012). Section 14.6. Bootstrap MITM Vulnerability. IETF. sec. 14.6. doi:10.17487/RFC6797. RFC 6797.
  19. ^ "Chromium HSTS Preloaded list". cs.chromium.org. Archived from the original on 18 February 2020. Retrieved 2019-07-10.
  20. ^ Butcher, Simon (11 September 2011). "HTTP Strict Transport Security". Archived from the original on 26 April 2019. Retrieved 27 March 2012.
  21. ^ Ali, Junade (20 October 2017). "Performing & Preventing SSL Stripping: A Plain-English Primer". Cloudflare Blog. Archived from the original on 14 December 2019. Retrieved 7 December 2017.
  22. ^ Maksutov, A. A.; Cherepanov, I. A.; Alekseev, M. S. (2017). Detection and prevention of DNS spoofing attacks. 2017 Siberian Symposium on Data Science and Engineering (SSDSE). pp. 84–87. doi:10.1109/SSDSE.2017.8071970. ISBN 978-1-5386-1593-5. S2CID 44866769.
  23. ^ "The HSTS super cookie forcing you to choose: "privacy or security?" -". sophos.com. 2 February 2015. Archived from the original on 11 February 2020. Retrieved 1 December 2015.
  24. ^ The Chromium Developers (17 November 2010). "Strict Transport Security - The Chromium Projects". Archived from the original on 20 March 2020. Retrieved 17 November 2010.
  25. ^ Jeff Hodges (18 September 2009). "fyi: Strict Transport Security specification". Archived from the original on 29 February 2020. Retrieved 19 November 2009.
  26. ^ Opera Software ASA (23 April 2012). "Web specifications support in Opera Presto 2.10". Archived from the original on 20 June 2018. Retrieved 8 May 2012.
  27. ^ Adam Langley [@agl__] (December 20, 2013). "Confirmed. See ~/Library/Cookies/HSTS.plist. Includes Chromium preloads as of some date and processes HSTS headers" (Tweet). Archived from the original on 9 May 2019. Retrieved 20 December 2013 – via Twitter.
  28. ^ "HTTP Strict Transport Security comes to Internet Explorer 11 on Windows 8.1 and Windows 7". windows.com. Archived from the original on 27 November 2019. Retrieved 12 June 2015.
  29. ^ "Internet Explorer Web Platform Status and Roadmap". Archived from the original on 29 June 2015. Retrieved 14 April 2014.
  30. ^ "Project Spartan and the Windows 10 January Preview Build - IEBlog". Archived from the original on 29 November 2019. Retrieved 23 January 2015.
  31. ^ Hodges; et al. "HTTP Strict Transport Security (HSTS) 6.1.2". ietf.org. Archived from the original on 22 July 2019. Retrieved 11 November 2016.
  32. ^ Hodges, J.; Jackson, C.; Barth, A. (2012). "RFC 6797 - HTTP Strict Transport Security (HSTS) 11.4 Implications of includeSubDomains". IETF Tools. sec. 11.4. doi:10.17487/RFC6797. RFC 6797.

External links

Featured content

Extended content
Featured article star.svg

Featured articles

Good articles

Good topics

Featured pictures

Featured portals


Category puzzle
Select [►] to view subcategories

Related portals

Things you can do

Associated Wikimedia

The following Wikimedia Foundation sister projects provide more on this subject:

Wikipedia's portals