21–30 of 31 posts
Earlier quoted context omitted.
Maybe the first step to avoid issues is to enforce SSL which is easy on any webserver before going HSTS.
Is there any downside, when using SSL, in enabling perfect forward secrecy?
As the article shows it's pretty straightforward to setup; if you can add a response header to your app then you'll be able to figure out how to harden your app with HSTS.
For my fellow web developers who like to learn by video, I've tried to make an easily digested screencast and a page of sketch notes to help get the word out about HSTS and explain what it protects against [2].
In 2014, everyone who uses https should enable PFS (ECDHE) and HSTS, at the very least.
In 2014, everyone who uses https should enable PFS (ECDHE) and HSTS, at the very least.
If you're on shared hosting, is it down to the hosting company to enable Forward Secrecy? Are there any shared hosts doing this yet?
HSTS should be an implicit browser feature, not a server-side add-on. There should not need to be a server-side flag required to enforce this behavior. If you go to an HTTPS page on a given domain, your browser should always prefer the HTTPS page, even if you try to follow an HTTP page. The reason is, if you were able to reach the page via HTTPS before, you should be able to reach it there again, and HTTP would only…
Earlier quoted context omitted.
If you're on shared hosting, is it down to the hosting company to enable Forward Secrecy? Are there any shared hosts doing this yet?
Elastic Loading Balancing for AWS customers & Heroku allow for perfect forward secrecy and Akamai customers can expect ECDHE in Q3 of this year.
# - Apache 2.4 PFS & BEAST attack Safe /etc/apache2/mods-enabled/ssl.conf
SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:!RC4:HIGH:!MD5:!aNULL:!EDH
SSLHonorCipherOrder on
SSLCompression off
# - HSTS Apache directive to force SSL (.htaccess or per site in control panel)
Header always set Strict-Transport-Security "max-age=15552000"
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [NC,R=301,L]These settings are giving me an A+ on SSLLabs.com... # - Apache 2.4 PFS & BEAST attack Safe /etc/apache2/mods-enabled/ssl.conf SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:!RC4:HIGH:!MD5:!aNULL:!EDH SSLHonorCipherOrder on SSLCompression off # - HSTS Apache directive to force…
The server does not support Forward Secrecy with the reference browsers. Grade reduced to A-
Maybe I need to upgrade to Apache 2.4.
These settings are giving me an A+ on SSLLabs.com... # - Apache 2.4 PFS & BEAST attack Safe /etc/apache2/mods-enabled/ssl.conf SSLProtocol -ALL +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:!RC4:HIGH:!MD5:!aNULL:!EDH SSLHonorCipherOrder on SSLCompression off # - HSTS Apache directive to force…
I tried that cipher suite list with Apache 2.2 and got my grade reduced from A to A-: The server does not support Forward Secrecy with the reference browsers. Grade reduced to A- Maybe I need to upgrade to Apache 2.4.