Does www. Mean Better Transport Layer Security?. Experience shows that most researchers and developers tend to treat plaindomains (those that are textitnot prefixed with quoteswww subdomains, e.g. quotesthis http URL) as synonyms for their equivalent wwwdomains (those that are prefixed with quoteswww subdomains, e.g. quotesjustify this http URL). In this paper, we analyse datasets of nearly two million plaindomains against their equivalent wwwdomains to answer the following question: textitDo plaindomains and their equivalent wwwdomains differ in TLS security configurations and certificates? If so, to what extent? Our results provide evidence of an interesting phenomenon: plaindomains and their equivalent wwwdomains differ in TLS security configurations and certificates in a nontrivial number of cases. Furthermore, wwwdomains tend to have stronger security configurations than their equivalent plaindomains. Interestingly, this phenomenon is more prevalent in the mostvisited domains than in randomlychosen domains. Further analysis of the top domains dataset shows that 53.35% of the plaindomains that show one or more weakness indicators (e.g. expired certificate) that are not shown in their equivalent wwwdomains perform HTTPS redirection from HTTPS plaindomains to their equivalent HTTPS wwwdomains. Additionally, 24.71% of these redirections contains plaintext HTTP intermediate URLs. In these cases, users see the final wwwdomains with strong TLS configurations and certificates, but in fact, the HTTPS request has passed through plaindomains that have less secure TLS configurations and certificates. Clearly, such a setup introduces a weak link in the security of the overall interaction.

Dont Forget to Lock the Front Door! Inferring the Deployment of Source Address Validation of Inbound Traffic This paper concerns the problem of the absence of ingress filtering at the network edge, one of the main causes of important network security issues. Numerous network operators do not deploy the best current practice  Source Address Validation (SAV) that aims at mitigating these issues. We perform the first Internetwide active measurement study to enumerate networks not filtering incoming packets by their source address. The measurement method consists of identifying closed and open DNS resolvers handling requests coming from the outside of the network with the source address from the range assigned inside the network under the test. The proposed method provides the most complete picture of the inbound SAV deployment state at network providers. We reveal that 32 673 Autonomous Systems (ASes) and 197 641 Border Gateway Protocol (BGP) prefixes are vulnerable to spoofing of inbound traffic. Finally, using the data from the Spoofer project and performing an open resolver scan, we compare the filtering policies in both directions.