How secure is HTTPS today? How often is it attacked? (2011)
1–10 of 22 posts
Re: How secure is HTTPS today? How often is it attacked? (2011)
#2So what alternatives are there to protecting HTTP? Is something like CurveCP feasible?
Re: How secure is HTTPS today? How often is it attacked? (2011)
#3So what alternatives are there to protecting HTTP? Is something like CurveCP feasible?
TACK (http://tack.io/), if widely implemented, would help a lot. As I understand it, if you visited a website regularly before it was compromised, then any future compromise along the lines described in the article (i.e., without stealing the server's private key) wouldn't affect you. I'm not sure if TACK is still alive or how on-board with it any browser developers are.
Re: How secure is HTTPS today? How often is it attacked? (2011)
#4I'm no cryptographer, but doesn't ChannelID (and, to a lesser extent, certificate pinning) mitigate a lot of these concerns?
certificate pinning is already in Chrome, and I think ChannelID is coming soon (if not already).
ChannelID: http://tools.ietf.org/html/draft-balfanz-tls-channelid-00
Re: How secure is HTTPS today? How often is it attacked? (2011)
#5I'm no cryptographer, but doesn't ChannelID (and, to a lesser extent, certificate pinning) mitigate a lot of these concerns? certificate pinning is already in Chrome, and I think ChannelID is coming soon (if not already). ChannelID: http://tools.ietf.org/html/draft-balfanz-tls-channelid-00
Perhaps, but I imagine it will easily be a decade before >90% of deployments are on browser versions that support Cert Pinning and ChannelID... think of all those enterprise deployments, universities and banks.
Re: How secure is HTTPS today? How often is it attacked? (2011)
#6So what alternatives are there to protecting HTTP? Is something like CurveCP feasible?
Some concerns about CurveCP's performance. Development seems slow from what I've been able to glean from the site and list:
Re: How secure is HTTPS today? How often is it attacked? (2011)
#7I'm no cryptographer, but doesn't ChannelID (and, to a lesser extent, certificate pinning) mitigate a lot of these concerns? certificate pinning is already in Chrome, and I think ChannelID is coming soon (if not already). ChannelID: http://tools.ietf.org/html/draft-balfanz-tls-channelid-00
It looks like ChannelID has been enabled since Chrome 24[1].
[1] https://code.google.com/p/chromium/issues/detail?id=136462#c...
Re: How secure is HTTPS today? How often is it attacked? (2011)
#8So what alternatives are there to protecting HTTP? Is something like CurveCP feasible?
The EFF's answer to this seems to be: HTTPS Everywhere + SSL Observatory + Sovereign Keys:
Re: How secure is HTTPS today? How often is it attacked? (2011)
#9The vulnerabilities mentioned seem to apply to large scale public websites. If a company serves a website for internal use then it unlikely to be a direct target. Could any of the vulnerabilities expose company data to large scale government data collection? It seems unlikely in the US but what about other authoritarian countries who have full control over their networks?
Re: How secure is HTTPS today? How often is it attacked? (2011)
#10Giving every CA the power to issue certificates for the whole web is insane. And depending on unauthenticated DNS to bootstrap the connection equally bonkers. Shouldn't we just use dnssec to have each domain publish it's own root certificate and be done with CA's for good? It would solve both issues and we wouldn't have to pay a third party just to be able to encrypt HTTP for our own domains.