Slashdot Mirror
Security Expert: Yahoo's Email Encryption Needs Work
itwbennett writes "On Tuesday, Yahoo delivered on a promise that it made in October to enable email encryption for everyone by default by January 8. While this is a great step, the company's HTTPS implementation appears to be inconsistent across servers and even technically insecure in some cases, according to Ivan Ristic, director of application security research at security firm Qualys. For example, some of Yahoo's HTTPS email servers use RC4 as the preferred cipher with most clients. 'RC4 is considered weak, which is why we advise that people either don't use it, or if they feel they must, use it as a last resort,' Ristic said."
I don't understand how yahoo can be alive today. It's been way behind competitors for about a decade. This type of story fits right in with that picture. Okay, if they are still alive, I guess they must be making money. But I'm happy they are still around. Now and then I find that I need to reconnect with a site I haven't used for years, where I registered with my yahoo address... And in that case, it's nice that I'm able to receive a password reset link. But what's the attraction today, besides that?
It was around at the right time to capture a large percentage of normies just getting online for the first time. These people don't like change. They don't really "like" computers in general. To them they're just tools; very frustrating and obtuse tools. Changing e-mail addresses is far more trouble than it is worth--we can barely get these people to give up Windows XP.
If you build it, nerds will come. Soylentnews.org
It's important to remember that only a year ago RC4 was a recommended solution and TLS1.2 support in browsers like Firefox and older operating systems has been slow to arrive. So I look at this as an important first step, with progressive refinements sure to follow. In the same way that Facebook introduced https in response to Tunisia and slowly made it an option for all users before making it default, Yahoo, while slow in adopting a model of default security, has to walk similar steps. They may have had an SSL-beta-option for the last year, but given their AOL-Like user base, I can understand being conservative in adopting new methods and being liberal in the ciphers they provide. Someone using Chrome in Mavericks may expect support for SPDY3 with AES-GCM, but for a user base that may be using IE6 or FF3 on XP still, for a company that caters to people who will never know what GCM or SHA2 is it best to avoid the headline, "Yahoo Mail is Broken for tens of thousands of users." They'll get there. Thanks for trying, Yahoo.
Now, can someone at Microsoft turn on STARTTLS? For that matter, I wish NANOG would turn on STARTTLS for inbound connections.
Also, IPv6... please... IPv6...
Unfortunately — in Firefox, at least — ciphers can only be toggled, not given a priority. Control over cipher selection (and other HTTPS parameters, such as key length, key exchange, hash (MD5/SHA)., etc.) lies with the server operator. In my own testing, the arbitrated HTTPS parameters are most frequently prioritized in some order without regard to strength, or prioritized from weakest-to-strongest (or perhaps least-to-most expensive to execute).
In order to retain manageable security, I have only TLS 1.0-1.2 enabled, MD5 disabled, all RC4-employing combos disabled, with the last being switchable via a check box provided by "CipherFox." (Additional features of use to "CipherFox" users are provided by "Calomel SSL Validation."; I recommend both.)
Thank you, Edward Snowden.
"Arguments from authority are worthless." —Carl Sagan
I wonder, in real world, how big percentage of the attacks are performed by man-in-the-middle (where strength of cypher matters). Between
1) 3 letter agencies just accessing content directly on Yahoo servers
2) Somebody hacking router between you and Yahoo (or evesdropping on physical line) and performing very costly cypher break
3) Having trojan/keylogger/whatever on your machine giving access to everything
How much point 2 is a problem compared to 1 and 3? People can write a lot about how usage of bad cipher will allow your mails to be cracked in 1 day instead of 5 billion years... but probably 99% of compromised emails are accessed through 1 or 3.
It is like with optimizing code. You could optimize hotspot where 99% of cpu time is spent, but it is hard. So instead you optimize all things around, making other 1% order of magnitudes faster and then forget than you cannot do anything about remaining 99%...
Make a few unimportant services secure-ish, but make very very sure that those services the NSA needs, email and IM, are on the weakest possible encryption.
last for years, light, compact, self cleaning, intuitive, rechargeable, restoreable (free the innocent stem cells), & more. that's us, powered by momkind et pals & built to lasting (before/until forever) self adjusting (little miss dna cannot be wrong) specifications
Yahoo reminds me of a journeyman heavyweight boxer taking the champ into deep rounds despite taking a serious beating. He simply will not go down.
They impress for sheer resilience, if for nothing else.
It would appear that Yahoo has a sign-in cookie problem with the mobile version they send to Chrome for iPad.
I signed out days ago and today when i typed http://mail.yahoo.com to login, I was instead directed to a view of all my emails, no need to sign in! But then their servers realised that and I was re-directed to the login window. So a brief 5 seconds, I was able to see my Inbox before the redirection occurred. Am no hacker but I can see how one would exploit this and Apple being Apple, I don't doubt for one second that someone with the wrong App or malware-ridden advert that play in Apps could take advantage of this!
I think your sega cd is broken.
Unfortunately, Iceweasel/Firefox don't indicate what cipher is used by an https connection, so Yahoo gives you a false sense of security with the use of RC4. So do many other websites.
There should be some indicator of just how secure an HTTPS connection is (maybe shifting the colour of the padlock from red through orange, yellow, and green as the strength of the cipher improves.) One should also be able to select which ciphers are considered valid by their browser.
I do not fail; I succeed at finding out what does not work.
Ivan Ristic; is he the father of Hugh?
No left turn unstoned.
I hope slashdotters realize that God moves faster than the speed of light.
While the article is correct and uses precise terminology, the summary is wrong to use the term "email encryption". That term is for encrypted email messages using PGP/GPG/S-MIME.
Yahoo have no framework for email encryption. This article is about use of HTTPS for their webmail service and (a) whether that has been implemented and, if so, (b) whether it has been done correctly.
The answers to which are: (a) mostly and (b) no.
"If you think the problem is bad now, just wait until we've solved it." --- Arthur Kasspe
Google Chrome 31.0.1650.63 + Gmail: RC4_128...
So if a website gives you only HTTPS with RC4 or HTTP in clear text as options - why would you choose clear text?
This is totally illogical. Yes RC4 sucks but it is better than clear text - ANYTHING is better than clear text. The only possible argument for this would be "false sense of security", but if you think average people pay any attention to that padlock in the status bar, you are delusional.
Why do people insist on using a web browser to read their mail instead of a proper e-mail client that implements proper TLS and every other feature that an e-mail client has that the web interface doesn't. It's not like people can't access their webmail over proper IMAP or POP3, which has advantages like seeing no advertising and the ability to use GnuPG or S/MIME encryption if one wants.
I got sick to death of my 10+ year yahoo account being "compromised", just out of the blue. My passwords are always secure using multiple caps/numbers/symbols etc.
My gmail/hotmail accounts never gave me this hassle.
Everytime you want to "recover" your account, you have to siv through pages, and pages of crap. Once you confirm your account with another email on file, you then have to provide your current password (which has been compromised and changed) to get in.
This could all be avoided if Yahoo mail actually had a "SECURE" system in the 1st place.
Hence why i haven't bothered with Yahoo Mail since. Yahoo is too far behind and too careless for my attention.
Hotmail and Gmail is all you need, and, will save you so much frustration.
With the abundance of older operating systems out there, I think browser code and general websites will still be hampered for quite sometime. For Yahoo and others that means the lowest common denominator needs to be supported for quite sometime. If you're rolling out your own website and can control those variables then certainly you can enforce TLS 1.2 with ciphers that are much stronger than RC4. If you can't control the client side in terms of minimum support that unfortunately means TLS 1.0 and RC4 if you want your website accessible by those old systems like XP, Vista etc. I don't think that the rest of us who have upgraded to Windows 7/8 or Linux shouldn't be left insecure however just because lowest common denominators have to be supported. Another point to remember is that TLS 1.2 has just rolled out within the last year or so in both Chrome and Firefox and Microsoft on the client side hasn't supported it until Windows 7 and IE 9; that means that site providers who want to reach the broadest spectrum of clients will have to shift support to the older, less secure protocols or lock people out of their website. I don't see Yahoo or Google doing that anytime soon. In fact, I just checked my connection with Yahoo and with Chrome 32.0.1700 it shows AES_256_CBC, on Firefox 26 it's using Camella 256... but both are using TLS 1.0. On Google with Chrome, AES_256_CBC with TLS 1.2 (woohoo!) but on Firefox 26 it's AES_128_CBC bit keys with TLS 1.1 even though I have AES_256 enabled... So that's something the Firefox folks will need to look into. FYI, in Firefox using about:config you can disable RC4 which is also how I configure the protocols and also set security.tls.version.max=3 to enable TLS 1.2 support for Firefox 25 and newer.
If you want to check what a website supports you can use the openssl client connect command with the appropriate switch. For example:
openssl s_client -connect mail.yahoo.com:443 -tls1_2 will attempt to connect to the yahoo mail service using only TLSv1.2 you can use -tls1_1 for obviously tlsv1.1, -tls1 for 1.0 etc. mail.yahoo.com doesn't support TLSv1.1 or TLSv1.2 but does support 1.0..
Harrison's Postulate - "For every action there is an equal and opposite criticism"
It's important to remember that only a year ago RC4 was a recommended solution and TLS1.2 support in browsers like Firefox and older operating systems has been slow to arrive.
It was only recommended as a counter to the BEAST attack, which exploited the way block ciphers worked. Since RC4 is a stream cipher it was not subject to this exploit, but a lot of people were uneasy about the recommendation. This is because while it was resilient against BEAST, everyone knew that RC4 was/is on its last legs, but it was the lesser of two evils.
When a workaround for BEAST was created (n/n-1 record splitting), and implemented in just about every browser, the BEAST attack became mostly moot, and at that point people should have put RC4 lower down on the list of allowed ciphers, whose only purpose was to support legacy clients (read: XP).
So basically RC4 should have been put at the bottom of the cipher list for about 18-24 months:
https://www.imperialviolet.org/2012/01/15/beastfollowup.html
If you're running a Unix system with OpenSSL 0.9.8, then put the following in your Apache configuration:
SSLHonorCipherOrder On
SSLCipherSuite DHE-RSA-AES128-SHA:AES128-SHA:RC4-SHA:HIGH:!MD5:!ADH:!DES
If you have OpenSSL 1.0.1+, then:
SSLHonorCipherOrder On
SSLCipherSuite ECDH+AES128:DH+AES128:RSA+AES128:RC4-SHA:HIGH:!ADH:!AECDH:!MD5:!DES
More details:
https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy
TLS 1.2 everwhere will add to the security, but the above will go a long way for SSL 3 and TLS 1.0:
https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what
PS: the above two weblogs are two good resources on keep up to date on TLS stuff. The traffic is low, and so when they do post, it's usually worth looking at.
Your locig fails as soon as with ROT13 - not better than clear text.
No, your logic fails, epically! Any obfuscation at all, no matter how weak, is better than NONE at all.
Quick! Without looking it up or resorting to pen and paper, what's this? Cnffjbeq
It's better than nothing, that's for sure.
www.gmail.com
Firefox 26 - openSuSe 12.2
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, 128 bit keys
I ran into someone yesterday with an MSN address -- the 72-year-old contractor about to repair my sidewalk.
The only person I deal with regularly using an AOL account is my in-law/accountant -- age 74.
Sounds like a two horse race to me. Wait, what about webtv?
I come here for the love
As others have said here, encryption from sender to receiver (including all hops in between) is what's really important, and would render encryption at the web/IMAP/POP level unnecessary. SMTP is used between all hops (unless, I assume, a message originates and ends at the same server), and survives from the early days of network computing when all of us who were on the net knew each other. It should not have survived to a public Internet, for reasons that became obvious pretty quickly.
Lack of security and spam are a direct result of the way SMTP works, and our youth is already moving to private "e-mail" infrastructures like Facebook and other social messaging private/direct messaging, so this won't be a problem for much longer. In a paper I wrote in 2007 I predicted the mass exodus from e-mail to social media messaging for these very reasons.
ROTFL LMAO
People like to bitch about things and have sensational head lines for link bait. A day after that article Yahoo has pfs support and doesn't support RC4 and this was 6 days after fulling turning on SSL/TLS for mail.
Looking at other sites like Ebay they sill don't support pfs and do support RC4. I would worry more about Ebay where I spend money vs Yahoo...
That would still be insecured. :P
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).