Next-gen HTTP 2.0 protocol will require HTTPS encryption

Thursday, November 14th, 2013

Sending data in plain text just doesn't cut it in an age of abundant hack attacks and mass metadata collection. Some of the biggest names on the Web--Facebook, Google, Twitter, etc.--have already embraced default encryption to safeguard your precious data, and the next-gen version of the crucial HTTP protocol will only work ...

Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program

Wednesday, November 13th, 2013

Microsoft is announcing a policy change to the Microsoft Root Certificate Program. The new policy will no longer allow root certificate authorities to issue X.509 certificates using the SHA-1 hashing algorithm for the purposes of SSL and code signing after January 1, 2016. Using the SHA-1 hashing algorithm in digital ...

HTTP Strict Transport Security becomes Internet standard

Friday, November 23rd, 2012

A Web security policy mechanism that promises to make HTTPS-enabled websites more resilient to various types of attacks has been approved and released as an Internet standard -- but despite support from some high-profile websites, adoption elsewhere is still low. HTTP Strict Transport Security (HSTS) allows websites to declare themselves accessible ...

Defcon Wi-Fi Hack Called No Threat to Enterprise WLANs

Sunday, August 5th, 2012

Enterprise Wi-Fi networks can keep using WPA2 security safely, despite a recent Defcon exploit that has been widely, but wrongly, interpreted as rendering it useless. The exploit successfully compromised a legacy authentication protocol, MS-CHAPv2, which was created by Microsoft years ago. But the vulnerabilities of this protocol (and other similar ones) ...

HTTPS Everywhere is now available for Google Chrome

Wednesday, February 29th, 2012

HTTPS Everywhere is a produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. Many sites on the web offer some limited support for encryption over HTTPS, but make it difficult to use. For instance, they may default to unencrypted HTTP, or fill encrypted pages with links ...