This repo contains TLS fingerprints documented in The Security Impact of HTTPS Interception.

Raw contains PCAP and p0f files of browsers and products we fingerprinted. Processing contains a subset of the Python code we used for processing data for the paper.

Note: these fingerprints were collected in early 2016. Browsers, antivirus products, and middleboxes have likely changed cryptographic configuration since this time. While this may be immediately apparent for versioned browsers like Firefox and Chrome, these could manifest as false positives in IE and Safari.