BEAST creators develop new SSL attack

BEAST creators develop new SSL attack.

-- Tom

 

How can you protect yourself from CRIME, BEAST’s successor?

How can you protect yourself from CRIME, BEAST’s successor?.

The post (above link) discusses an excellent hypothetical way to defend against the attack which prompted various modifications (see comments in linked article above) in several products prior to the actual release of the CRIME attack at a conference later this month in Argentina.

-- Tom

 

SSL/TLS compression exploit disclosed

(http://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor/19914#19914)

 

Here is where I am glad that MS isn't supporting Google's "great" new SPDY protocol as IE is immune to the attack. When it comes to encryption new proposals should be rigorously tested, not rushed out before it's even a standard.

Still annoyed at the lack of pushing TLS 1.2 though... so depressing that still only IE and Opera support it.

 

Some thoughts on the CRIME attack.

The above linked post if from the Tor project perspective.

-- Tom

 

Many ways to break SSL with CRIME attacks, experts warn.

-- Tom

 

Internet architects mull changes to fight SSL-busting CRIME attacks.

-- Tom