Qualys Security Labs

You should also check out the Trustworthy Internet project report on SSL/TLS deployment quality.[0] The big increase in B and C grades this month (compared to last month) is due to Qualys's SSL Labs tester becoming more strict about DH parameter size (less than 2048 bits caps your grade at B; see also Logjam), lack of TLS 1.2 support (caps your grade at C), and RC4 deployment with TLS 1.1 and 1.2 (caps your grade at C, RC4 deployed for TLS 1.0 still only caps you at B).[1] [0] https://www.trustworthyinternet.org/ssl-pulse/ [1] https://community.qualys.com/blogs/securitylabs/2015/05/21/ssl-labs-11…

Another issue worth mentioning when discussing chain cert: Should the root certificate go on the server? [1] https://community.qualys.com/thread/11026

yes, i know, but accoring to the blogpost below it should be no problem for newser browsers when using tls 1.2, but might e usefull to keep compatibility with very legacy clients, no? disclaimer: i'm not a crypto-guru, the ciphers used are copypasta'd from https://www.ssllabs.com/projects/best-practices/. https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-…

Is that the same as Ivan Ristic's recommendation at https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring…

I have been doing a lot of SSL/TLS research the last few days and found the following to be great resources from Qualys too: - https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring… - https://www.ssllabs.com/downloads/SSL_TLS_Deployment_Best_Practices_1.…

RC4 is no longer recommended, but is the best supported method as I understand it [0]. There's also the issue that the most widely available versions of openssl do not support PFS or tls 1.2. You need to download and compile a newer version of openssl (rather than using packages - RHEL in particular since that's what we use), and then compile whatever web server or proxy again with the newer openssl support. [0] https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-…

Ivan has already adjusted his views on RC4 as you can read here: https://community.qualys.com/blogs/securitylabs/2013/09/17/updated-ssl… And the qualys SSL analyzer no longer penalizes for not mitigating Beast, they just warn about it in orange but there is no longer a penalty as of a couple weeks ago.

I'm curious why CloudFlare includes !EDH as part of their cipher suite options... Guessing they were just following the recommendations from https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating-… but having a specific reason would be interesting to know. EDH ciphers are generally slower (so I could see why a company that wants connections to be fast wouldn't want to use them), but at the same time, they also allow for forward secrecy. Seems like CloudFlare might want to prioritize forward secrecy over speed, as per http://blog.cloudflare.com/cloudflare-prism-secure-ciphers. Maybe I'm missing something here, though... Perhaps that !EDH should be !ADH?

Knowing what we know today, attacks against RC4 are not yet practical, and thus there is no reason to panic. But we must act now. Given the huge incentive for researchers to continue to break RC4, it's reasonable to expect that the attacks will continue to improve. Yes, SSL Labs will start to penalize RC4 at some point, but not just yet. Later today we will start warning people about the problems. I've just published the recommendations here: RC4 in TLS is Broken: Now What? https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-…

The last thing we were keeping it around for was the extension support, but they unfortunately killed that so I now recommend Edge over Firefox for resource-constrained systems. It's not there yet, but it's got a brighter future than Firefox. But yeah nothing pissed me off more than them saying they support choice when they kill off well-supported standards they don't like [1], fire employees over their (common) religious beliefs [2], take the longest to roll out critical security features [3], and prioritize shitty UI updates that nearly everyone hates [4]. All I keep hearing is that the new multi-process is so much faster, everything is great now, but every time I run it on fairly decent systems (i7 from late 2013) it takes multiple seconds to switch tabs. It really is a joke that their head of marketing wasn't fired for that post, it only supports the true thing that Mozilla has come to stand for: hypocrisy. [1] https://en.wikipedia.org/wiki/Web_SQL_Database [2] https://en.wikipedia.org/wiki/Brendan_Eich [3] https://community.qualys.com/thread/12421 [4] https://www.ghacks.net/2013/11/23/80-unhappy-firefoxs-australis-interf…

A couple points: * !RC4 - RC4 is in doubt[1]. The only reason to keep it around was to mitigate the BEAST attack, which is now mitigated[2] client side, so RC4 should be dropped. * gzip off; - Explicitly disable gzip compression to avoid BREACH[3] * Ensure TLS deflate is off to mitigate CRIME[4] (this is the default in most, but not all combinations of nginx/OpenSSL). * openssl ciphers -v is great for testing what ciphers match your settings. * Comment your nginx config! You will not remember all of this when you next look at it (or someone else does). And some of it will certainly be outdated. Security is not a static game. [1] http://www.theregister.co.uk/2013/09/06/nsa_cryptobreaking_bullrun_ana… [2] https://community.qualys.com/blogs/securitylabs/2013/09/10/is-beast-st… [3] http://en.wikipedia.org/wiki/BREACH_%28security_exploit%29 [4] http://en.wikipedia.org/wiki/CRIME_%28security_exploit%29

Both Chacha20 and Poly1305 are optimized (by design) for running on general purpose CPUs. AES-GCM using AES-NI instructions is still faster, but not that much [0]. [0] https://community.qualys.com/thread/16005

HSTS is currently used by 2.8% of all websites, up from 1.2% this time last year. [1] If people are using Qualys SSL Labs tool to check their "grade", they won't be awarded an A+ grade unless their HSTS max-age is at least 6 months [2], so I'm going to assume the average is somewhere close to that due to how common usage of that tool is. My grandma still uses browser bookmarks, but I have no none-anecdotal source for this. BoA could absolutely do all the things you just mentioned, but all of them are more difficult than simply replacing their certificate using Comodo or some other trusted root CA. [1] https://w3techs.com/technologies/details/ce-hsts/all/all [2] https://community.qualys.com/thread/15972

This thread on Qualys forums might be helpful: https://community.qualys.com/thread/16055

This is awesome. A few days ago I posted this question at the Qualys SSLLabs forum: "Is there a reason for still having TLSv1.1 enabled?" https://community.qualys.com/thread/16565 Considering SSLv3 has been "dead" for a while now, and it still completes more handshakes than TLSv1.1, there's really no reason to keep TLSv1.1 around for most sites without very particular concerns. (But we're still holding on to TLSv1.0 until it's in the few-percent range.)

https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating-… > During the summer rumours about a new attack against SSL started circulating. > The only reliable way to defend against BEAST is to prioritise RC4 cipher suites, as proposed by PhoneFactor. RC4? That heap of junk? You're kidding. [18 months later] > Last week, a group of researchers announced significant advancements in the attacks against RC4, unveiling new weaknesses as well as new methods to exploit them. Jeez, who could have seen that one coming.

SHA-1 is being deprecated. E: For more reading: https://community.qualys.com/blogs/securitylabs/2014/09/09/sha1-deprec…

Good stuff: RC4 is officially removed from the (edit: default set of, thanks ewegrump) cipher suites. Some background: https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-…

Interesting. It looks like the page itself is encrypted with more standard crypto using AES [0], but the video itself is served from a connection using RC4 [1]. As far as I can tell from this article [2], attacks on RC4 are only theoretical at this point, but it seems reasonable that they should upgrade the video serving domain to be consistent with the page itself (though maybe it's done for performance reasons - either encrypting a large video stream costs a lot of CPU time or decrypting it on the client is too slow or CPU intensive for watching video smoothly, so perhaps they are sticking with RC4 for a good reason). Still, as my old crypto prof said, "Attacks only get better over time. They never get worse." [0]: http://i.imgur.com/OcpziFa.png [1]: http://i.imgur.com/57T8bay.png [2]: https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-…

Can somebody explain why they are still using RC4 in their configuration? https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-…

Sure, https://en.wikipedia.org/wiki/Transport_Layer_Security#Attacks_against… https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-…

So is that the point you were originally trying to make instead of discussing etymology? While we're quibbling prescriptively about terminology, I'd argue that the IE exploit patched earlier this week was in fact a zero day since it was not public knowledge. > The vulnerability underlying CVE-2013-3897 was found internally at Microsoft and would have been fixed in MS13-080. However, in the last two weeks, attacks against the same vulnerability became public, but since the fix was in the code already, it enabled Microsoft to address the vulnerability, CVE-2013-3897, in record time. https://community.qualys.com/blogs/laws-of-vulnerabilities/2013/10/08/… (unnecessary text omitted)

Thanks for the heads up ck2. I've updated the config to add ocsp stapling. The certificate really has a extra(unnecessary) root certificate, I will solve this later today. The RC4 part is based on this article https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring… But I will do some more research and update the post.

Forward secrecy with https? https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring…

I indeed managed to get a B without trying to mitigate against BEAST (d). The trouble does seem to be that RC4 isn't vulnerable to BEAST, but it's not desirable because of its other vulnerabilities. Since BEAST was fixed in TLS 1.1, I think you can require 1.1+ and get an A, but the test suggests you might break things for a significant chunk of users. Even if you get a B because you're vulnerable to BEAST, if you prioritise 1.1+ ciphers, you'll still fail to get an A but you'll mitigate against it. It looks like Qualys themselves have a post on this, actually: https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating-…

this one seemed fine. worked for me: https://community.qualys.com/blogs/securitylabs/2013/06/25/ssl-labs-de…

This is kind of ironic considering it's Adam Langley's website, but it appears his server is not indicating that it supports secure renegotiation, and apparently in the latest Firefox that's grounds to refuse a connection[1]. See: https://www.ssllabs.com/ssltest/analyze.html?d=pond.imperialviolet.org https://wiki.mozilla.org/Security:Renegotiation https://community.qualys.com/blogs/securitylabs/2010/10/06/disabling-s… If you set security.ssl.require_safe_negotiation to false in about:config you should be able to establish a connection. [1] Edit: actually it's not; the parent poster had tweaked settings in about:config ;-)

> 155a7a01308fa0807f722c5984bd91fb You may want to read the last phrase of my comment. > I find "high-end graphic card (~$500) can compute 10 billion md5 hashes per second" a bit unbelievable And yet those are the numbers oclhashcat lite publishes for 0.10 on a stock Radeon HD6990 (10886.3M c/s): http://hashcat.net/oclhashcat-lite/ > Yes I realise that md5'ed password strings aren't random Which is the whole point, and the knowledge the tools I mentioned use: https://community.qualys.com/blogs/securitylabs/2012/06/08/lessons-lea… (note: the article is about sha1 hashes — which are about 3 times as expensive to compute as md5 — and is done on an older CPU, not GPU-assisted hashing) > Just saying. Just saying absolutely nothing?

Passwords are inherently valuable, imo. The more knowledge you have about a person's password habits, the easier it is to crack other services as well. Witness LinkedIn: https://community.qualys.com/blogs/securitylabs/2012/06/08/lessons-lea… I'd be willing to bet very few people use truly unique passwords across all their accounts. While personal responsibility is paramount, human nature is what it is, and (again, imo) all sites that require authentication should do it well (over SSL).