Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Freak Attack SSL/TLS Vulnerability

freakattack.com

Post reply on HN
Print view View original

71–80 of 120 posts

Re: The Freak Attack SSL/TLS Vulnerability

#71

Post by nodesocket »

bryogenic wrote: post #70
nodesocket wrote: post #32

We wrote a blog post: The perfect SSL nginx configuration ( http://blog.commando.io/the-perfect-nginx-ssl-configuration/ ) which details all the nginx directives to set to achieve an A+ rating on sslLabs, including mitigation of FREAK, POODLE, and HEARTBLEED.

In addition to your configs I had to enable HSTS to achieve an A+ Add to a server section: add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";

We left out http headers, because that usually can be done at the application level, or in location{} blocks in nginx. I wouldn't recommend setting headers globally in http{}.

Re: The Freak Attack SSL/TLS Vulnerability

#72

Post by dadrian »

diltonm wrote: post #61
geofft wrote: post #57

Earlier quoted context omitted.

What is your evidence that the vulnerability testing was done by someone supported by your tax dollars, instead of by a computer that was part of a botnet controlled by your government's cyberenemies?

Here is a check for the IP for freakattack.com: http://www.tcpiputils.com/browse/ip-address/141.212.122.194 Edit: They have been on that list for a while, so either the staff at the University is incompetent or they don't care; what was your point again?

This is why reverse DNS exists. http://researchscan450.eecs.umich.edu/

Re: The Freak Attack SSL/TLS Vulnerability

#73

Post by mbrubeck »

sandworm wrote: post #10

https://freakattack.com/clienttest.html I just tested my devices. Linux machines running firefox all passed. On the other hand my Android phone did not, lots of RSA_EXPORT ciphers accepted. But as with nearly every security story: linux/foss software for the WIN!

Firefox for Android is not vulnerable to FREAK, and is one of the few ways to get a modern, supported browser engine on older Android devices.

Re: The Freak Attack SSL/TLS Vulnerability

#75

Post by thaumaturgy »

nodesocket wrote: post #32

We wrote a blog post: The perfect SSL nginx configuration ( http://blog.commando.io/the-perfect-nginx-ssl-configuration/ ) which details all the nginx directives to set to achieve an A+ rating on sslLabs, including mitigation of FREAK, POODLE, and HEARTBLEED.

Thank you for taking the time to do that. But, would you consider adding to the article a bit? I come from the slightly older "never run a command you don't understand" school of systems administration. Your second section is OK at describing what's going on in the configuration file, but the first section is a bit sparse.

It's still a helpful starting point though.

Re: The Freak Attack SSL/TLS Vulnerability

#76

Post by [deleted] »

sandworm wrote: post #10

https://freakattack.com/clienttest.html I just tested my devices. Linux machines running firefox all passed. On the other hand my Android phone did not, lots of RSA_EXPORT ciphers accepted. But as with nearly every security story: linux/foss software for the WIN!

[deleted]

Re: The Freak Attack SSL/TLS Vulnerability

#77

Post by moyix »

skuhn wrote: post #55
ephemeralgomi wrote: post #51

Earlier quoted context omitted.

There are too many names on that list - not to contact, but to trust. To everyone that you give secret advance notice, you're potentially handing a zero-day.

That's true. Have they contacted them now? Do these places which will only fix a problem if they're shamed into it actually know that they are on the wall of shame? More to the point: has a widespread public vulnerability ever before been released alongside a list of everyone who is vulnerable to it? I can't recall such a thing ever happening.

The same folks providing the list this time around also made one for Heartbleed. It was posted roughly the same time as the initial disclosure, from what I recall.

http://web.archive.org/web/20140411064356/https://zmap.io/he...

Re: The Freak Attack SSL/TLS Vulnerability

#79

Post by skuhn »

moyix wrote: post #77
skuhn wrote: post #55

Earlier quoted context omitted.

That's true. Have they contacted them now? Do these places which will only fix a problem if they're shamed into it actually know that they are on the wall of shame? More to the point: has a widespread public vulnerability ever before been released alongside a list of everyone who is vulnerable to it? I can't recall such a thing ever happening.

The same folks providing the list this time around also made one for Heartbleed. It was posted roughly the same time as the initial disclosure, from what I recall. http://web.archive.org/web/20140411064356/https://zmap.io/he...

So they did, I wasn't aware of that.

This sort of proves my point from another comment: they stopped updating the list shorting after it was posted, and so all of these domains are forever stuck on the shame list.

Viewing domains from the Alexa top 1M list so many times today also makes it very clear that it is total crap.

Post reply on HN