Slashdot Mirror
SSL Pulse Project Finds Just 10% of SSL Sites Actually Secure
Trailrunner7 writes "A new project that was setup to monitor the quality and strength of the SSL implementations on top sites across the Internet found that 75 percent of them are vulnerable to the BEAST SSL attack and that just 10 percent of the sites surveyed should be considered secure. The SSL Pulse project, set up by the Trustworthy Internet Movement, looks at several components of each site's SSL implementation to determine how secure the site actually is. The project looks at how each site is configured, which versions of the TLS and SSL protocols the site supports, whether the site is vulnerable to the BEAST or insecure renegotiation attacks and other factors. The data that the SSL Pulse project has gathered thus far shows that the vast majority of the 200,000 sites the project is surveying need some serious help in fixing their SSL implementations."
..giving a false sense of security.
For example, I've personally discovered hundreds of servers with compromised PHP scripts that worked merrily along via HTTPS, looking very secure. Unfortunately, attackers can attack a poorly written script over HTTPS exactly as easily as via HTTP, compromise it, and steal information (or whatever) just fine.
expandfairuse.org
If you can inject JS into a secure site, BEAST is the least of your concerns.
This is them trying to gain awarness of an XSS assisted attack.
XSS can be more dangerous than the actual traffic.
They are just checking if servers support backwards complience for older users who would not be able to use SSL othewise.
This is like saying all sites that have custom rules to make older IE play nice are insecure.
SSL just encrypts the channel.
SSL does not fix anything else.
How could it?
Crap code on a website is still crap code on a website whether you have an encrypted channel or clear text channel.
So I tried my SNI enabled domain, which redirects to a dummy domain if you don't support SNI.
And https://www.ssllabs.com/ssltest doesn't work with the SNI domain, thinking my certificate is invalid.
So a few things:
* It's sponsored by Qualis, I don't see how that's trustworthy. You see that only once you do the actual validation. They're here to make money like any other corporation. Nonprofit stuff? Bitch please.
* It doesn't work with SNI so there's million domains wrongly counted as invalid
* Their cert isn't even an EV cert
It's even worse when you consider the sites using mixed content, which passed with flying colors on the analysis. To do a proper test you really need to check every page that uses SSL.
More about mixed content: https://www.eff.org/https-everywhere/deploying-https
Fixing Mixed content is not always so difficult, we replaced image links to use "//" instead of "http://", which allows it to use whatever protocol you are already using. This also works if you still might need to fall back to http:/// for whatever archaic reason (or for us development).
...is the fact that when I open the site that hosts the article, my browser puts a red, diagonal line over the "https" part of the address field, and claims that it contains "resources which are not secure". Sure, it's probably insignificant, but I have to enjoy the irony, given the topic of the article. :)
http://www.youtube.com/watch?v=5WVOwRY_b-Q#t=58m11s
Is this testing for the absence of BEAST workarounds which are present in all current respectable ssl libraries? Or does it just look for sites using TLS 1.0/SSL3 with block mode ciphers?
Mitt?
In what way is SSL a metaphor for all that?
Please go back to reddit. Thank you.
Butthurt much?
No, he meant "//". http://paulirish.com/2010/the-protocol-relative-url/
Agreed.
Can we get /. to prevent the first, say 5, post replies from AC?
Let the first 5 or so posts be from registered users only. AC cannot reply to the OP until 5 or so replies to OP by registered users have been made.
5 can be tweaked...to an optimized value 3-5 i'd say.
Maybe this will stop the silly 1st post...from AC.....then again..maybe now we will egt
6th Post crap from ACs...but still better than reading a crappy 1st post.
Your connection to threatpost.com is encrypted with 256-bit encryption. However, this page includes other resources which are not secure. These resources can be viewed by others while in transit, and can be modified by an attacker to change the behavior of the page.
The connection uses TLS 1.0.
The connection is encrypted using AES_256_CBC, with SHA1 for message authentication and DHE_RSA as the key exchange mechanism.
The connection is not compressed.
"is that a third of the sites still support SSL 2.0, a protocol that is considered insecure."
I hope there is no relation between ssl 2.0 and ssh 2.0, what i use to protect my shell sessions...
Can we get /. to prevent the first, say 5, post replies from AC?
I like.
It's always fun when slashdot advocates censorship. Well you and the 3 people who modded you up...
What if theres some article about company X, and the first person to reply is an employee of that company who needs to stay anonymous.
Replace company with government, etc, etc.
Sorry if you guys don't like the trolls, but anonymous coward serves the same important purpose it always has.
The test is unable (due to really poor Java crypto libraries) to negotiate EDH with secure key sizes (it only goes up to 1024 bit).
This could be skewing the data towards older or outdated implementations/configurations.
I guess you don't remember the days of the GNAA. Those guys knew how to troll.
/. first posts were like circa 2005. (Never go to a GNAA site, they built several browser bombs. I doubt any still work, but I'm not about to test that theory.)
Today's bullshit is pretty dainty by comparison. The moderation system does a pretty good job of taking them down, unless you're browsing at -1. GNAA people generally never posted AC and they were way more offensive. Wiki GNAA if you want to see what
I'm posting AC because this sort of thing belongs below the average user's threshold.
The sort of "stealing" here isn't related to copyright as much as to credentials, which are more like trade secrets and in a way even like trademarks in that they assert that something has been produced by a particular party.
Doesn't the same argument explain why many sites still use old versions of SSL?
Not especially. The vast, vast majority of browsers still in use support SSL 3 or later. The same cannot be said of SNI because a lot of people are still running Internet Explorer for Windows XP or Android Browser for Android 2. I don't think the operator of a public web site can rely on SNI being widely deployed until about 24 months from now, when Internet Explorer for Windows XP leaves extended support.
Agreed, AC has a valid purpose in many cases and yes to the AC who posted earlier about ACs making more useful contributions than I have, both good and BAD. I could say the same for you too. I'm not here to argue and rant off like some others. Its not a pissing contest like some would want it to be.
The intention was not so much to absolutely censor AC, but more to prevent the silly and nonsensical AC posts like First Post silliness.
The ACs are the ones who mostly post the nonsensical/offensive comments. People signed in, generally don't do so. Admittedly, registered users do post nonsense as well, but I'd venture to say less than ACs. I may be wrong.
Anonymity obviously has its benefits, like in the good example you made but it also allows people to use that to do things they normally would not do if they were recognized. I was just trying to suggest a way to reduce nonsense, although I admit that at times nonsense can be fun.
Adding Humor, Satire and intelligent wit is fine....real/proper/fun/witty Trolls.
Nonsensical "Yeah....I got first post" everytime..gets a little silly.
Of course censorship is not generally good...and yes.....I may have not thought of all the reasons AC serves when I made the post. This is /. People are waiting to pounce. ;) Thats fine. Just had good intentions. Wanted /. to be better. Good intentions are not always good enough.
There are pros and cons with everything. ..so yeah...I may have been wrong...in the big scheme of things.
There are Pros like the one you mentioned. ACs do post useful info. I'll give you that.
I guess I will just have to live with the cons of having to deal with silliness, meaningless rants.
Come to think of it...we need to laugh sometimes.
So yeah. Lets the ACs run wild. Let them say what we want. We can mod them the hell down if its crappy content.
Cue next rant/response/pounce/for/against/whatever.
So if AC can post from post -say- 3, a new trend will flourish on /. "3rd post", i.e. be the first AC to post something. Not sure it'll change much. Moreover, doing so, and even talking about it like we currently do, legitimizes the (poor) AC quest, i.e. get some (weak) recognition from the only posting operation those AC are able to produce (and of course the insulting AC post that will follow this very post).
Slashdot, fix the reply notifications... You won't get away with it...
First, let me say I have no life. Second, I have a registered account with "Excellent" karma and regularly receive moderation points. Third, I have written probably 100 first posts anonymously, most of them without mentioning first post, and many of them with scores of +5, most of them funny. Why do I do it anonymously rather than start a career as a Slashdot comic? Well, the money's not great in that, plus that's not the public image I want. Also because of how karma works here, where Funny mods don't count but negative ones against Funny mods do, I'd quickly end up in the hole, making my account unusable.
Just to backup what I'm saying, here's a few examples of my posts (which I know I can't verify, but seriously, who would go to this much trouble?
Human Species May Split in Two
Apache Comes With Too Much Community Overhead?
Sun Blasts Another CME at Earth
Inside the TRS-80 Model 100
Halloween Pumpkin Carving
_
Although, for the record, the post I'm most proud of wasn't a first post, but this classic:
Browser Wars Declared Over
Much longer than that. It's not like millions of pirate copies of XP out there in China, Japan and South Korea [running Internet Explorer 6] ever get support from MS.
It's also not like they'd be both 1. interested in primarily English-language or otherwise Latin-alphabet sites and 2. unable to install a competing browser or the Google Chrome Frame browser helper object on their own machine.
So we can safely conclude that you don't read your own post then ;-)
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
OK. I guess you don't quite understand how SSL works. Think of SSL as a really long pipe between your house and a water processing plant that nobody can penetrate outside your house and the water processing plant. It doesn't stop the processing plant from detecting if the water is bad. It keeps people located outside the water plant from tapping into the pipe and testing the waters quality. In fact they can't even tell if there is water in it.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
The Qualys SSL Labs SSL Server Test application seems to be a well written web application and a not-so-well written analysis tool.
I tried it with server names that resolved to multiple IP addresses and the behaviour of the SSL Server Test UI changed and showed that someone had put some thought into how the application should work.
The report itself though leaves something to be desired. The Summary section provides a nice clear way for managers to evaluate their systems and provide targets for improvement. e.g. "Go make all our web sites get an overall rating of A". Unfortunately, there is no clear relationship between the Summary section and the Details section, which is the section that lists things that can be fixed. They look closely aligned, but oddities keep coming up. I've been able to compare two web sites, www.google.org and kcert.com which have the same overall rating but kcert.com has all sorts of problems listed in the details, but www.google.com has none. If my web site scored B in the summary I might well try and fix some of the problems that kcert.com have because they are the high visibility problems in the report, but apparently they count for nothing. On top of that, www.google.org has nothing wrong listed in its detailed report, but it still only scores 85%. Who knows what magic is required for that last 15%?
One easy fix might be to deploy to IPv6. The report doesn't do IPv6 and if you can't be tested, then you can't fail.