I wrote a server which presents your browser's TLS Client Hello message in multiple formats. It can be used directly or in CI tests to check for TLS privacy pitfalls (session resumption, fingerprinting, system time exposure) and security shortcomings (deprecated TLS versions, weak cipher suites, missing features, etc). It supports HTTPS and Gemini, is written in Go and is free/libre software.
My main motivation for making this was my interest in the privacy pitfalls of TLS, primarily session resumption (session identifiers can be used much like tracking cookies) and TLS fingerprinting. Also, I wanted there to be an online service that provided the full Client Hello message as JSON.
I hope some of you will find it useful. The code is available here:
https://tildegit.org/nervuri/client-hello-mirror
Its development led to some unexpected places, such as finding a CVE-worthy flaw in Go's TLS library and thinking up a new version of JA3. I posted the development story here:
No comments yet.
