Re: [gentoo-user] Re: Heartbleed fix - question re: replacing self-signed certs with real ones

[Dale <rdalek1967@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 3025 bytes --]

Mick wrote:
> On Sunday 20 Apr 2014 10:10:42 Dale wrote:
>> Mick wrote:
>
>>> SSL-Session:
>>>     Protocol  : TLSv1
>>>     Cipher    : RC4-MD5
>>>
>>> ======================================
>>>
>>> RC4 is considered completely broken today, even for Microsoft!  :-)
>>>
>>>   http://en.wikipedia.org/wiki/RC4
>>>
>>> The good news are that your bank's servers do not leak any secrets at
>>> this moment and it seems they never did (they use SUN servers).
>>
>> Yet.  I would rather not be the next customer to have his ID stolen like
>> Target, I think the chain Micheal's was stolen in the past couple days
>> but not positive on that yet.
>>
>> That bank is not a small bank and I pay fees each month for them to be
>> able to keep their stuff updated.  If they can't be bothered to keep it
>> updated and then turn around and give me a card that sucks, well, oh
>> well.  < picture a thumbs up here >
>
> Just a 1/3 of all websites offer TLSv1.2 at the moment and hardly any
public
> sites offer it as an exclusive encryption protocol, because they would
lock
> out most of their visitors.  This is because most browsers do not yet
support
> it.  MSWindows 8.1 MSIE 11 now offers TLSv1.2 by default and has
dropped the
> RC4 cipher (since November last year).  I understand they are planning
to drop
> SHA-1 next Christmas and have already dropped MD5 because of the Flame
> malware.  This should push many websites to sort out their encryption
and SSL
> certificates and move away from using RC4 and SHA1 or MD5.  As I said
RC4 has
> been reverted to by many sites as an immediate if interim defence
against the
> infamous BEAST and Lucky Thirteen attacks.
>
> According to the Netcraft SSL Survey (May 2013) only a third of all web
> servers out there offer Perfect Forward Secrecy to ensure that even if
the
> encryption keys were to be compromised, previous communications cannot be
> retrospectively decrypted.
>
> Elliptic Curve algorithms are not yet included in many browsers and in
any
> case the security of these in a post-Snowden world should be questionable
> (well, at least the arbitrarily specified NIST-NSA sponsored curves,
which
> OpenSSL is heavily impregnated with).
>
> What I'm saying is that there may be no perfect banking website out
there,
> because Internet security is screwed up at the moment, but it is
always worth
> looking for a better bet.
>

Well, my bank only got a C for it's grade.  For what it costs every
month, it should get a A+.  I don't have one of those free checking
accounts.  I pay fees each month for mine.  Plus I have already been
planning to switch ever since they switched my debit card from Visa to
Discover.  I'm tired of finding something online or going into a
business to buy something and then find out they don't take Discover. 
It's just a matter of speed of switching that has changed.

Basically, just one more nail in the coffin.

Dale

:-)  :-)

-- 
I am only responsible for what I said ... Not for what you understood or
how you interpreted my words!


[-- Attachment #2: Type: text/html, Size: 4397 bytes --]