SSL Pulse Project Finds Just 10% of SSL Sites Actually Secure 62
Trailrunner7 writes "A new project that was setup to monitor the quality and strength of the SSL implementations on top sites across the Internet found that 75 percent of them are vulnerable to the BEAST SSL attack and that just 10 percent of the sites surveyed should be considered secure. The SSL Pulse project, set up by the Trustworthy Internet Movement, looks at several components of each site's SSL implementation to determine how secure the site actually is. The project looks at how each site is configured, which versions of the TLS and SSL protocols the site supports, whether the site is vulnerable to the BEAST or insecure renegotiation attacks and other factors. The data that the SSL Pulse project has gathered thus far shows that the vast majority of the 200,000 sites the project is surveying need some serious help in fixing their SSL implementations."
Re: (Score:2, Funny)
Butthurt much? [phoenixnewtimes.com]
Re:Happy Friday from the Golden Girls! (Score:5, Interesting)
Agreed.
Can we get /. to prevent the first, say 5, post replies from AC?
Let the first 5 or so posts be from registered users only. AC cannot reply to the OP until 5 or so replies to OP by registered users have been made.
5 can be tweaked...to an optimized value 3-5 i'd say.
Maybe this will stop the silly 1st post...from AC.....then again..maybe now we will egt
6th Post crap from ACs...but still better than reading a crappy 1st post.
Re: (Score:1)
Can we get /. to prevent the first, say 5, post replies from AC?
I like.
Re: (Score:2)
So we can safely conclude that you don't read your own post then ;-)
Re: (Score:1)
Agreed, AC has a valid purpose in many cases and yes to the AC who posted earlier about ACs making more useful contributions than I have, both good and BAD. I could say the same for you too. I'm not here to argue and rant off like some others. Its not a pissing contest like some would want it to be.
The intention was not so much to absolutely censor AC, but more to prevent the silly and nonsensical AC posts like First Post silliness.
The ACs are the ones who mostly post the nonsensical/offensive comments. Peo
Re: (Score:2)
SSL can be kinda like a weight lifting belt.. (Score:5, Insightful)
For example, I've personally discovered hundreds of servers with compromised PHP scripts that worked merrily along via HTTPS, looking very secure. Unfortunately, attackers can attack a poorly written script over HTTPS exactly as easily as via HTTP, compromise it, and steal information (or whatever) just fine.
SSL just encrypts the channel. (Score:5, Insightful)
SSL just encrypts the channel.
SSL does not fix anything else.
How could it?
Crap code on a website is still crap code on a website whether you have an encrypted channel or clear text channel.
Re:SSL just encrypts the channel. (Score:5, Funny)
Re:SSL just encrypts the channel. (Score:5, Insightful)
Which is perfect, it prevents a Network Intrusion Detection System from preventing the attack. ;-)
Re: (Score:1)
OR you could do what anyone who actually does SSL at any sort of scale does, and run your IDS between your frontend (load balancers, accelerators, F5s, nginx boxes, whatever) and your actual backend servers that serve the PHP (perl/ruby/fastcgi/whatever) request......
Re: (Score:1)
Except if the target is using the IPS behind a TLS concentrator.
If the target is big enough to have an IPS, there is a relatively good chance that they've also got a TLS concentrator.
CAPTCHA: "possible"
The internet is a series of pipes! (Score:2)
Not copyright either (Score:2)
JS injection, SSL is the least of your problems (Score:3, Interesting)
If you can inject JS into a secure site, BEAST is the least of your concerns.
This is them trying to gain awarness of an XSS assisted attack.
XSS can be more dangerous than the actual traffic.
They are just checking if servers support backwards complience for older users who would not be able to use SSL othewise.
This is like saying all sites that have custom rules to make older IE play nice are insecure.
No SNI, thats very truth worthy of a study (Score:5, Interesting)
So I tried my SNI enabled domain, which redirects to a dummy domain if you don't support SNI.
And https://www.ssllabs.com/ssltest [ssllabs.com] doesn't work with the SNI domain, thinking my certificate is invalid.
So a few things:
* It's sponsored by Qualis, I don't see how that's trustworthy. You see that only once you do the actual validation. They're here to make money like any other corporation. Nonprofit stuff? Bitch please.
* It doesn't work with SNI so there's million domains wrongly counted as invalid
* Their cert isn't even an EV cert
Re: (Score:2)
You see that only once you do the actual validation
You mean the "Qualys SSL Labs" site title and logo and (c) Qualys inc wasn't enough to tip you off?
Did anyone ever figure out how the fuck beast worked in the first place? Last I heard it's some javascript that apparently magically appears in the browser and does some stuff which lets a sniffer figure out some of the cookies. If they're running arbitrary code on the server or the client (the PoC used a java bug to violate same-origin [theregister.co.uk] and rather than just
Re: (Score:3, Insightful)
Re: (Score:3)
If you are running a public web site you want people to see it, and, across the global audience, too many people cannot use it, which is why public sites don't use it either.
Doesn't the same argument explain why many sites still use old versions of SSL?
Re: (Score:2)
Re:No SNI, thats very truth worthy of a study (Score:5, Insightful)
But it does not explain why about 33% of the servers surveyed support SSL v2.0, which virtually no client wants to use, and which is also insecure.
Because, as a server operator, I don't especially care if clients are spoofed. I don't perform any authentication of their identities anyway, so my security doesn't decrease.
If the client wants to use an insecure protocol (or is incorrectly configured to use an insecure protocol in preference to a new one), then that is the client's concern. I'm not going to stop them if they don't want to -- they can turn off SSL2 in their browser options (most modern browsers ship this way anyway) if they care that much. A properly configured browser will use SSL3 or TLS in preference to SSL2 anyway if the server supports it, which mine does, so most people will never notice.
Speaking purely from a commercial standpoint, denying customers access to my services because they are using an out of date or badly configured system makes no sense.
Re: (Score:2)
denying customers access to my services because they are using an out of date or badly configured system makes no sense
Unless you are in a sector where you can be held responsible when your users' authentication is compromised, such as banking.
Re: (Score:2)
denying customers access to my services because they are using an out of date or badly configured system makes no sense
Unless you are in a sector where you can be held responsible when your users' authentication is compromised, such as banking.
Yes, which probably account for 1% of all SSL enabled servers, so is statistically insignificant.
No SNI in IE on XP or in Android 2.x (Score:3)
Doesn't the same argument explain why many sites still use old versions of SSL?
Not especially. The vast, vast majority of browsers still in use support SSL 3 or later. The same cannot be said of SNI because a lot of people are still running Internet Explorer for Windows XP or Android Browser for Android 2. I don't think the operator of a public web site can rely on SNI being widely deployed until about 24 months from now, when Internet Explorer for Windows XP leaves extended support.
Re: (Score:1)
Much longer than that. It's not like millions of pirate copies of XP out there in China, Japan and South Korea [ie6countdown.com] ever get support from MS.
Businesses with legal copies, holding on for dear life to IE6's activeX is probably not as large a number anyway.
CJK users of English sites (Score:2)
Much longer than that. It's not like millions of pirate copies of XP out there in China, Japan and South Korea [running Internet Explorer 6] ever get support from MS.
It's also not like they'd be both 1. interested in primarily English-language or otherwise Latin-alphabet sites and 2. unable to install a competing browser or the Google Chrome Frame browser helper object on their own machine.
Re: (Score:3)
Any version of IE and Safari (and very old Chrome) on Windows XP and the Android browser on any Android 2.x do not support SNI.
So that doesn't make SNI very useful on the public Internet right now. :-(
Mixed Content another issue (Score:5, Informative)
It's even worse when you consider the sites using mixed content, which passed with flying colors on the analysis. To do a proper test you really need to check every page that uses SSL.
More about mixed content: https://www.eff.org/https-everywhere/deploying-https [eff.org]
Fixing Mixed content is not always so difficult, we replaced image links to use "//" instead of "http://", which allows it to use whatever protocol you are already using. This also works if you still might need to fall back to http:/// [http] for whatever archaic reason (or for us development).
Protocol-relative URLs (Score:5, Informative)
Re: (Score:2)
What you're referencing has always been used as, at best, an ugly hack to accommodate mistakes and bad decisions when representing complete documents transmitted over HTTP(S). At worst (and this is how I view it), it simply serves to perpetuate the abysmal practice of serving data via both encrypted and plaintext channels over the network. This is a terrible idea for many reasons, and should be soundly discouraged at every possible turn.
Re:Protocol-relative URLs (Score:4, Informative)
The web page doesn't care whether it's being served over HTTP or HTTPS, that's only an issue for the web server. So, the web server configuration can have all the rules and redirections to enforce a particular policy, and the web page will work any time that gets updated, without having to have every link in every page rewritten.
Re: (Score:2)
As a postscript to my last reply, I must admit that I love your sig.
Re:Mixed Content another issue (Score:4, Informative)
What i find particularly amusing.... (Score:1)
Re: (Score:3)
And it isn't just because of the ads, it is also their own content. Some jpg's are loaded from the same hostname over http.
Security Now 321: The Beauty Of B.E.A.S.T. (Score:5, Interesting)
Really? (Score:3)
Re: (Score:3, Informative)
ssl 2.0 insecure? (Score:2)
"is that a third of the sites still support SSL 2.0, a protocol that is considered insecure."
I hope there is no relation between ssl 2.0 and ssh 2.0, what i use to protect my shell sessions...
Re:ssl 2.0 insecure? (Score:5, Informative)
SSH doesn't use SSL, it has its own transport layer protocol (which is described in RFC 4253).
(To confuse things a bit, OpenSSH does use OpenSSL, but only the cryptography functions. The SSL part of OpenSSL is completely untouched by OpenSSH).
Re: (Score:1)
Not as useful as it might be (Score:1)
The Qualys SSL Labs SSL Server Test application seems to be a well written web application and a not-so-well written analysis tool.
I tried it with server names that resolved to multiple IP addresses and the behaviour of the SSL Server Test UI changed and showed that someone had put some thought into how the application should work.
The report itself though leaves something to be desired. The Summary section provides a nice clear way for managers to evaluate their systems and provide targets for improvement.
Re: (Score:1)