Abstract If two or more identical HTTPS clients, located at different geographic locations (regions), make an HTTPS request to the same domain (e.g. example.com ), on the same day, will they receive the same HTTPS security guarantees in response? Our results give evidence that this is not always the case. We conduct scans for the top 250000 most visited domains on the Internet, from clients located at five different regions: Australia, Brazil, India, the UK, and the US. Our scans gather data from both application (URLs and HTTP headers) and transport (servers’ selected TLS version, ciphersuite, and certificate) layers. Overall, we find that HTTPS inconsistencies at the application layer are higher than those at the transport layer. We also find that HTTPS security inconsistencies are strongly related to URLs and IPs diversity among regions, and to a lesser extent to the presence of redirections. Further manual inspection shows that there are several reasons behind URLs diversity among regions such as downgrading to the plain-HTTP protocol, using different subdomains, different TLDs, or different home page documents. Furthermore, we find that downgrading to plain-HTTP is related to websites’ regional blocking. We also provide attack scenarios that show how an attacker can benefit from HTTPS security inconsistencies, and introduce a new attack scenario which we call the “region confusion” attack. Finally, based on our analysis and observations, we provide discussion, which include some recommendations such as the need for testing tools for domain administrators and users that help to mitigate and detect regional domains’ inconsistencies, standardising regional domains format with the same-origin policy (of domains) in mind, standardising secure URL redirections, and avoid redirections whenever possible.

中文翻译：

---

探索 HTTPS 安全不一致：跨区域视角

摘要 如果位于不同地理位置（地区）的两个或多个相同的 HTTPS 客户端在同一天向同一个域（例如 example.com ）发出 HTTPS 请求，它们是否会收到相同的 HTTPS 安全保证响应？我们的结果证明情况并非总是如此。我们对 Internet 上访问量最大的前 250000 个域进行扫描，这些域来自五个不同地区的客户：澳大利亚、巴西、印度、英国和美国。我们的扫描从应用程序（URL 和 HTTP 标头）和传输（服务器选择的 TLS 版本、密码套件和证书）层收集数据。总体而言，我们发现应用层的 HTTPS 不一致比传输层的不一致。我们还发现 HTTPS 安全不一致与地区之间的 URL 和 IP 多样性密切相关，并在较小程度上存在重定向。进一步的人工检查表明，不同地区的 URL 多样性背后有几个原因，例如降级到纯 HTTP 协议、使用不同的子域、不同的 TLD 或不同的主页文档。此外，我们发现降级到普通 HTTP 与网站的区域阻塞有关。我们还提供了攻击场景，展示了攻击者如何从 HTTPS 安全不一致中受益，并介绍了一种新的攻击场景，我们称之为“区域混淆”攻击。最后，根据我们的分析和观察，我们提供了一些讨论，其中包括一些建议，例如需要为域管理员和用户提供有助于缓解和检测区域不一致的测试工具，