Mick wrote:
> On Saturday 19 Apr 2014 19:41:02 Dale wrote:
>> Mick wrote:
>
>>> and look for this info:
>>>
>>> New, TLSv1/SSLv3, Cipher is RC4-SHA
>>> Server public key is 2048 bit
>>> Secure Renegotiation IS NOT supported
>>> Compression: NONE
>>> Expansion: NONE
>>>
>>> SSL-Session:
>>>     Protocol  : TLSv1
>>>     Cipher    : RC4-SHA
>>
>> I have this little padlock looking thing too.  I dug around and found
>> this info:
>>
>> CN = VeriSign Class 3 Extended Validation SSL SGC CA
>> OU = Terms of use at https://www.verisign.com/rpa (c)06
>> OU = VeriSign Trust Network
>> O = "VeriSign, Inc."
>> C = US
>>
>> PKCS #1 RSA Encryption
>>
>> There is another place with info but it doesn't allow me to highlight it
>> so that I can copy and paste.  Hmmmmmm.
>>
>> Anyway, is that reasonable for a bank to use?  In case you haven't
>> noticed, I'm not a wealth of info on encryption, just rich in
>> questions.  I just know that it is supposed to make things unreadable
>> without a password, pass key or whatever.
>>
>> This is currently my bank.
>>
>> http://cadencebank.com/
>>
>> Since they changed to a card that a lot of stores don't take, that could
>> be changing real soon.
>
> You need to go to the URL that they provide for secure banking, not
the home
> page of their main website.  They seem to offer a lot of services under
> different URLs.  Not all of them have the same level of protection. 
Picking
> two URLs at random:
>
> The Fluent account login page takes me to:
>
>   https://portal.cadencebank.com/consumer/
>
> and openssl s_client tells me:
>
> ======================================
> New, TLSv1/SSLv3, Cipher is AES128-SHA
> Server public key is 2048 bit
> Secure Renegotiation IS supported
> Compression: NONE
> Expansion: NONE
> SSL-Session:
>     Protocol  : TLSv1
>     Cipher    : AES128-SHA
> ======================================
>
> So, they use TLSv1, as opposed to the latest TLSv1.2 and their digital
> signature is with the AES symmetric cipher with 128bit keys. This is
> considered safe enough for today. They also use the SHA1 hash which is
less
> secure (if you are paranoid that someone may change the packets
payload in
> flight).  Since 2004 it was found that practical collision attacks
could be
> launched on MD5, SHA-1, and other hash algorithms and NIST has launched a
> competition for the next secure hash SHA3.  However, MD5 and SHA1 are
used so
> widely today it could take a loooong time for them to disappear.
>
>
> However, picking up another banking service of theirs I see that they are
> using RC4 with MD5:
>
> ======================================
> New, TLSv1/SSLv3, Cipher is RC4-MD5
> Server public key is 2048 bit
> Secure Renegotiation IS supported
> Compression: NONE
> Expansion: NONE
> SSL-Session:
>     Protocol  : TLSv1
>     Cipher    : RC4-MD5
> ======================================
>
> RC4 is considered completely broken today, even for Microsoft!  :-)
>
>   http://en.wikipedia.org/wiki/RC4
>
>
> The good news are that your bank's servers do not leak any secrets at
this
> moment and it seems they never did (they use SUN servers).
>

Yet.  I would rather not be the next customer to have his ID stolen like
Target, I think the chain Micheal's was stolen in the past couple days
but not positive on that yet.

That bank is not a small bank and I pay fees each month for them to be
able to keep their stuff updated.  If they can't be bothered to keep it
updated and then turn around and give me a card that sucks, well, oh
well.  < picture a thumbs up here >

Dale

:-)  :-)

-- 
I am only responsible for what I said ... Not for what you understood or
how you interpreted my words!