Welcome to the Summary of the 2019 F5 Labs TLS Telemetry Report.
This year, we expanded the scope of our research to bring you deeper insights into how encryption on the web is constantly evolving. We look into which ciphers and SSL/TLS versions are being used to secure the Internet’s top websites and, for the first time, examine the use of digital certificates on the web and look at supporting protocols (such as DNS) and application layer headers.
A lot has happened in the world of encryption since we published the 2017 TLS Telemetry Report. Over the past two years, standards have been updated, browsers have evolved and a number of new protocols have been released that aim to secure all the remaining cleartext protocols still in wide use today.
Meanwhile, the global debate between technology providers and governments (also known as Crypto Wars 2.0) continues to rumble on. Governments are increasingly trying to control how encryption is used, and we frequently see poorly written (or purposefully vague) legislation introduced.
HTTPS Everywhere?
Chrome, the most widely used web browser, now fetches over 86% of web pages over secure HTTPS connections. That figure approaches 100% for Chrome OS-based devices when accessing Google properties like Gmail. For Firefox, HTTPS page loads are slightly lower but still at an impressive 80.5% average. Of the Alexa top 1 million sites, almost a third now accept TLS 1.3 connections.
In 2014, 98% of the web servers accepting HTTPS connections still allowed the use of SSL v3. This changed rapidly in October 2014 when the POODLE vulnerability was announced.
At the end of 2019 F5 Labs joined the GitHub Security Lab coalition and as part of our new TLS Telemetry report. As part of the Security Lab coalition, we asked GitHub to help us investigate the use of OpenSSL in open-source applications. They used their LGTM code analysis tool to examine the use of the world’s most popular TLS library in 9,435 open source projects. They found that less than 1% of analyzed projects were using OpenSSL recommended methods to validate hostnames.
We also compared the malicious use of encryption to the wider web and found that domains that serve malware used a combination of legitimate public web services (such as blogging platforms and redirectors), valid certificates on malicious domains, and subtle tricks to conceal the true identity of the website. Phishing sites, used to lure victims into giving away their credentials, were even worse. The majority used HTTPS to hide traffic and appear genuine, and many sites attempted to imitate common financial institutions or e-commerce retailers.
Encryption standards are constantly evolving, so it’s crucial to stay up to date with current best practices. We hope you find this summary of the 2019 F5 Labs TLS Telemetry Report helpful and illuminating.
About the authors
David Warburton
Director, F5 Labs | F5
David Warburton is director of F5 Labs. He has worked in the IT industry for over 20 years, starting life as a full stack developer before wrangling with the perils of cloud architecture and then moving the serene and peaceful life of cyber security. His research covers a wide range of topics from the deeply technical, such as cryptography, to the more real-world sociotechnical side of security. Warburton has given talks around world for Infosec (UK), GovWare (Singapore), Crikeycon (Australia), ITBN (Hungary), Digital Transformation EXPO (UK) and for the UK military. Warburton has made dozens of international media appearances on TV, print and industry podcasts, including BBC World News, Sky News, SABC, The Guardian and Risky Business. He is the author of F5 Labs publications including the annual ‘Phishing and Fraud’ and ‘TLS Telemetry’ reports, and recently he co-authored the SSL/TLS/HTTPS scanning devops tool ‘Cryptonice’ which helps organisations improve their application security posture. Warburton was awarded a Masters in Information Security from Royal Holloway University of London where his thesis was on the use of security and cryptography in internet-of-things (IoT).
More research by David Warburton
Remi Cohen
Threat Research Evangelist | F5
Remi Cohen was a Threat Research Evangelist with F5 Labs. Prior to F5 she worked for a large national laboratory conducting vulnerability assessments, and research on current threats as well as an civilian analyst for the US Department of Defense. Her specialty areas of research include mobile vulnerabilities, Industrial Control Systems, and Eastern European threats. She is an associate of (ISC)2 by passing the CISSP exam and is certified in both COMPTIA Security+ and ECCouncil C|EH. She holds a Master’s degree from New Mexico State University in Industrial Engineering as well as Bachelor’s degrees in Computer Science and Government from Georgetown University.
More research by Remi Cohen
Debbie Walkowski
Security Threat Researcher | F5
As a Security Threat Researcher for F5 Labs, Debbie specialized in writing threat-related educational content as well as blogs, articles, and comprehensive research reports about application threat intelligence. She had worked for F5 for 10 years and has more than 20 years’ experience in the technology industry as a technical writer. She holds SANS GIAC Information Security Professional (GISP), GIAC Security Essentials (GSEC), and GIAC Security Fundamentals (GISF) certifications. Her bachelor’s degree from the University of Washington is in scientific and technical communication with an emphasis in computer science. She is the author of 18 technology books published by IDG Books, SAMS, QUE, and Alpha Books.
More research by Debbie Walkowski
