They didn't yet?!
Bing now supports https
31–40 of 48 posts
Re: Bing now supports https
#32They get an A from Qualys (yay?): https://www.ssllabs.com/ssltest/analyze.html?d=bing.com … but no PFS :/
LOL even my blog with free SSL cert from startssl gets A. I suppose that's nothing to brag about. https://www.ssllabs.com/ssltest/analyze.html?d=ahmetalpbalka...
In my opinion, anyone should be able to get an A with a free certificate, or at least nothing beyond administration costs. Certificates cost nothing to make. Anyone paying a dime is just helping keep up the illusion that it is expensive.
Re: Bing now supports https
#33Issuer: "Microsoft Internet Authority" Just like with Google: Google Internet Authority. Interesting to see big companies not trusting intermediate CA's anymore that they go through the length of becoming a CA themselves. However it could also be a cost effective strategy.
Well that certificate comes from the Baltimore Cybertrust Root certificate. Doesn't that mean MS is just an intermediate CA?
Re: Bing now supports https
#34Issuer: "Microsoft Internet Authority" Just like with Google: Google Internet Authority. Interesting to see big companies not trusting intermediate CA's anymore that they go through the length of becoming a CA themselves. However it could also be a cost effective strategy.
With the amount of subdomains they use, and seeing as they each have a browser with significant market share, it's a no-brainer. I'm frankly surprised it took so long for them to bring such an essential security task in-house.
Wildcard certificates.
Re: Bing now supports https
#35no document.referrer. So this is untrackable. I think it's a shame, search engines should pass a referrer and hide searched term for privacy.
I thought this was inherent in following a link from a https resource to a http resource with a different authority, that the browser would never expose the secure URL (via header or script state) to the insecure content.
Re: Bing now supports https
#36Earlier quoted context omitted.
In other words, don't use elliptic curves? And, therefore, don't use forward secrecy? Does current browser support for curves even allow you to set up a "NIST-free" ECDHE TLS server?
There's also DHE, which is not "NIST-corrupted" I guess. As far as I know, in theory it should be possible to use the Brainpool curves in TLS, but haven't seen such a thing in actual use.
Right, but it's also not performant enough at scale.
NSS doesn't support the Brainpool curves. OpenSSL does, but no mainstream browser uses it.
Re: Bing now supports https
#37Earlier quoted context omitted.
In other words, don't use elliptic curves? And, therefore, don't use forward secrecy? Does current browser support for curves even allow you to set up a "NIST-free" ECDHE TLS server?
You're using the same argument RSA used when they decided to just keep Dual EC DRBG, because it was "too late to change", even though they knew it was a backdoor. Granted, I think they are lying and did it on purpose, but even their lie is pretty bad logic. They need to talk to Google, Mozilla and others, and decide on using a new set of safe curves in their browsers. Using a broken one is not a solution.
IE and IIS never used Dual EC as their CSPRNG.
The "NIST corrupted curves" you refer to are, for all intents and purposes, the Internet standard curves. Microsoft could provide a configuration that used only the Brainpool curves, but no browser would be able to talk to them.
Re: Bing now supports https
#38Earlier quoted context omitted.
There's also DHE, which is not "NIST-corrupted" I guess. As far as I know, in theory it should be possible to use the Brainpool curves in TLS, but haven't seen such a thing in actual use.
Right, but it's also not performant enough at scale. NSS doesn't support the Brainpool curves. OpenSSL does, but no mainstream browser uses it.
Support in unreleased versions (openssl 1.0.2) counts as support?
Re: Bing now supports https
#39Re: Bing now supports https
#40Earlier quoted context omitted.
Setting up SSL/TLS on a single server in a virtual environment that you don't even have to manage is a different story than getting major changes tested and deployed on a huge multi-billion dollar, multi-tenant distributed system spanning not just the globe but multiple teams, languages, people and requirements.
Just so i'm clear, your argument is essentially: we should be more impressed more because they designed it in a way that made it difficult for them to do this?
There's no way to design a multi-million-user search engine in a way that makes it easy to design, test, and deploy major changes.