How secure is SSL?

One of the fallouts from the leaks by former NSA consultant Edward Snowden is that people are paying more attention now to what data intelligence agencies are collecting.

In the wake of a report last month from The Guardian that the NSA can keep encrypted information indefinitely comes a blog from Internet security firm Netcraft that SSL, one of the oldest security protocols, isn’t safe any more. Instead organizations should turn to PFS – perfect forward secrecy – for better encryption

Serdar Yegulalp of Network Computing interviewed a software engineer who adds some extra context. The link is below.
(Image from Shutterstock)

Some background: SSL – short for security sockets layer, and more recently called TLS – is used by browsers to protect passwords, credit card details and personal information. You’ll find it enabled when the browser URL reads “https”. But, argues Netcraft, if SSL’s private key is cracked or made available through a court order, then all of a Web site’s traffic can be decrypted at once.

 PFS, used in conjunction with SSL, makes that very difficult because it generates a temporary key. If you follow along, Yegulalp’s engineer agrees that SSL works best with PFS enabled.

Web site administrators will find this informative.

Read the whole story here.



Related Download
Understanding how IBM Spectrum Protect enables hybrid data protection Sponsor: IBM
Understanding how IBM Spectrum Protect enables hybrid data protection
Abdicating your company’s data protection responsibilities to the first cloud solution provider you encounter is just as unwise as doing nothing at all to leverage the cloud. On the other hand, it can be a wise decision to investigate what results you might achieve by choosing a backup technology that is capable of supporting a hybrid protection approach capable of covering both on-premises technology and offsite cloud capabilities.
Register Now