Slashdot Mirror
SSL Pulse Project Finds Just 10% of SSL Sites Actually Secure
Trailrunner7 writes "A new project that was setup to monitor the quality and strength of the SSL implementations on top sites across the Internet found that 75 percent of them are vulnerable to the BEAST SSL attack and that just 10 percent of the sites surveyed should be considered secure. The SSL Pulse project, set up by the Trustworthy Internet Movement, looks at several components of each site's SSL implementation to determine how secure the site actually is. The project looks at how each site is configured, which versions of the TLS and SSL protocols the site supports, whether the site is vulnerable to the BEAST or insecure renegotiation attacks and other factors. The data that the SSL Pulse project has gathered thus far shows that the vast majority of the 200,000 sites the project is surveying need some serious help in fixing their SSL implementations."
Thank you for being a friend
Traveled down the road and back again
Your heart is true, you're a pal and a cosmonaut.
And if you threw a party
Invited everyone you ever knew
You would see the biggest gift would be from me
And the card attached would say, thank you for being a friend.
..giving a false sense of security.
For example, I've personally discovered hundreds of servers with compromised PHP scripts that worked merrily along via HTTPS, looking very secure. Unfortunately, attackers can attack a poorly written script over HTTPS exactly as easily as via HTTP, compromise it, and steal information (or whatever) just fine.
expandfairuse.org
If you can inject JS into a secure site, BEAST is the least of your concerns.
This is them trying to gain awarness of an XSS assisted attack.
XSS can be more dangerous than the actual traffic.
They are just checking if servers support backwards complience for older users who would not be able to use SSL othewise.
This is like saying all sites that have custom rules to make older IE play nice are insecure.
SSL just encrypts the channel.
SSL does not fix anything else.
How could it?
Crap code on a website is still crap code on a website whether you have an encrypted channel or clear text channel.
So I tried my SNI enabled domain, which redirects to a dummy domain if you don't support SNI.
And https://www.ssllabs.com/ssltest doesn't work with the SNI domain, thinking my certificate is invalid.
So a few things:
* It's sponsored by Qualis, I don't see how that's trustworthy. You see that only once you do the actual validation. They're here to make money like any other corporation. Nonprofit stuff? Bitch please.
* It doesn't work with SNI so there's million domains wrongly counted as invalid
* Their cert isn't even an EV cert
It's even worse when you consider the sites using mixed content, which passed with flying colors on the analysis. To do a proper test you really need to check every page that uses SSL.
More about mixed content: https://www.eff.org/https-everywhere/deploying-https
Fixing Mixed content is not always so difficult, we replaced image links to use "//" instead of "http://", which allows it to use whatever protocol you are already using. This also works if you still might need to fall back to http:/// for whatever archaic reason (or for us development).
...is the fact that when I open the site that hosts the article, my browser puts a red, diagonal line over the "https" part of the address field, and claims that it contains "resources which are not secure". Sure, it's probably insignificant, but I have to enjoy the irony, given the topic of the article. :)
http://www.youtube.com/watch?v=5WVOwRY_b-Q#t=58m11s
Is this testing for the absence of BEAST workarounds which are present in all current respectable ssl libraries? Or does it just look for sites using TLS 1.0/SSL3 with block mode ciphers?
It's a metaphor for the eternal slashdot argument between religion and science.
We all knew how to be secure with SSL but somehow we never were!
This is why "science" can't replace "religion".
Science is a philosophy (like religion) but practical science is engineering; and it's so hard to get right even when you (think you) know what you are doing; and you still have to have faith to rely on others doing it right.
Religion has at least two sides, managed superstition (which is false religion and not philosophy) and the quest for truth (which is philosophy).
Science seeks truth which can be discovered by the scientific method which can operate on the planes of existence below us which are subject to our manipulation and therefore repeatable.
Religion seeks truth that must be taught and revealed from planes of existence above us, which are not subject to strict scientific method any more than an ant can do an experiment upon the scientist in whose lab it is being studied. (But yet as parents will sometimes make themselves appear subject to the scientific method in order to teach and be understandable to their children, so might God).
One prophet said: "Religion teaches obedience to laws which are important to society but unenforceable." The truth or value of religious teachings is subject to examination and verification through practice, but as it changes the natures of those performing the experiment it is perhaps less scientific even thought it may be satisfying.
The argument is not be between "science" and "religion" in those who seek truth rather than to establish their position or authority.
A scientist that makes an error or deceives is as unhelpful to the novice as a religionist that makes an error or deceives. Both being human, both are likely. Seekers of truth cannot afford to make over generalisations from the behaviour of adherents, or take certainty from probability when looking for a needle in a haystack, and do not confuse the comfort of acclaim with accuracy. There is a difference between being right and being told you are right. To want truth is to accept that you might never be satisfied, but hope anyway. (This can be exchanged for social acceptance at any time).
Those who would manipulate the ignorant can do so under the cloak of science, religion, politics or fear, and so on. We cannot be certain that we will always detect such people immediately, and their natures may change mid-course. To treat all religionists or all scientists as proxies for those who manipulate, is to remain deceived.
Religion and science both require trust in the teacher.
The ultimate teacher in religion is not seen but can be known through the teaching process.
I believe that the ultimate teacher in science is the same person.
I am a Mormon, I am a Christian, and I seek truth
blog.sam.liddicott.com
jkhkjhkjhlkh
No, he meant "//". http://paulirish.com/2010/the-protocol-relative-url/
Your connection to threatpost.com is encrypted with 256-bit encryption. However, this page includes other resources which are not secure. These resources can be viewed by others while in transit, and can be modified by an attacker to change the behavior of the page.
The connection uses TLS 1.0.
The connection is encrypted using AES_256_CBC, with SHA1 for message authentication and DHE_RSA as the key exchange mechanism.
The connection is not compressed.
"is that a third of the sites still support SSL 2.0, a protocol that is considered insecure."
I hope there is no relation between ssl 2.0 and ssh 2.0, what i use to protect my shell sessions...
The test is unable (due to really poor Java crypto libraries) to negotiate EDH with secure key sizes (it only goes up to 1024 bit).
This could be skewing the data towards older or outdated implementations/configurations.
The sort of "stealing" here isn't related to copyright as much as to credentials, which are more like trade secrets and in a way even like trademarks in that they assert that something has been produced by a particular party.
Doesn't the same argument explain why many sites still use old versions of SSL?
Not especially. The vast, vast majority of browsers still in use support SSL 3 or later. The same cannot be said of SNI because a lot of people are still running Internet Explorer for Windows XP or Android Browser for Android 2. I don't think the operator of a public web site can rely on SNI being widely deployed until about 24 months from now, when Internet Explorer for Windows XP leaves extended support.
Much longer than that. It's not like millions of pirate copies of XP out there in China, Japan and South Korea [running Internet Explorer 6] ever get support from MS.
It's also not like they'd be both 1. interested in primarily English-language or otherwise Latin-alphabet sites and 2. unable to install a competing browser or the Google Chrome Frame browser helper object on their own machine.
OK. I guess you don't quite understand how SSL works. Think of SSL as a really long pipe between your house and a water processing plant that nobody can penetrate outside your house and the water processing plant. It doesn't stop the processing plant from detecting if the water is bad. It keeps people located outside the water plant from tapping into the pipe and testing the waters quality. In fact they can't even tell if there is water in it.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
The Qualys SSL Labs SSL Server Test application seems to be a well written web application and a not-so-well written analysis tool.
I tried it with server names that resolved to multiple IP addresses and the behaviour of the SSL Server Test UI changed and showed that someone had put some thought into how the application should work.
The report itself though leaves something to be desired. The Summary section provides a nice clear way for managers to evaluate their systems and provide targets for improvement. e.g. "Go make all our web sites get an overall rating of A". Unfortunately, there is no clear relationship between the Summary section and the Details section, which is the section that lists things that can be fixed. They look closely aligned, but oddities keep coming up. I've been able to compare two web sites, www.google.org and kcert.com which have the same overall rating but kcert.com has all sorts of problems listed in the details, but www.google.com has none. If my web site scored B in the summary I might well try and fix some of the problems that kcert.com have because they are the high visibility problems in the report, but apparently they count for nothing. On top of that, www.google.org has nothing wrong listed in its detailed report, but it still only scores 85%. Who knows what magic is required for that last 15%?
One easy fix might be to deploy to IPv6. The report doesn't do IPv6 and if you can't be tested, then you can't fail.
This is a real great resource that you're providing and you have away without cost. I adore seeing websites that be aware of the price of providing a quality resource without cost. It’s the previous what circles appears routine. Big information useful info San Jose Electrical