4 ms·

And this is exactly why perfect forward secrecy is so important.

• anologwintermut 13y ago
  Did he actually use forward secure SSL cipher suites for everything?
  • jtdowney 13y ago
    The site currently negotiates for DHE-RSA-AES256-SHA, which is forward secure.
    • anologwintermut 13y ago
      Right. But if you connect with a browser that doesn't support that? And what about SMTP connections?
      • jamesaguilar 13y ago
        Presumably if you care about security you are using a browser that does PFS and have personally verified that it is working.
        • anologwintermut 13y ago
          If you cared about security and knew enough to check that, you probably knew enough not to trust server side crypto and were using PGP or S/MIME on top of it or using OTR instead of email for secure conversations. That aside, this still leaves the very important question of SMTP traffic.
        • sillysaurus2 13y ago
          You mean browsers actually fall back to non-perfect-forward-secrecy? They even have the option of doing that? That's interesting if true. Ideally it should be enforced by the server, and if the browser can't support it, then the browser can't see the webpage.
          • anologwintermut 13y ago
            You can only support forward secure cipher suits. This will result in rejected connections as you suggested. Lavabit doesn't do this, they support non-forward secure ones. Worse, they don't offer a cipher-suit order preference and the cipher suits they offer are actually pretty shitty (no ECDH_ECDSA, 1024bit DHE). The way they have it configured now means anyone using the default browser on windows(IE) or OSX(Safari) doesn't end up negotiating a forward secure session. Chrome and Firefox do end up being forward secure. See SSL Lab's test result here[0] They support TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA [0]https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2Flavabit.com https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2...
          • harshreality 13y ago
            They have to, because many sites don't support any PFS ciphersuites. For instance, banks. https://www.ssllabs.com/ssltest/analyze.html?d=www.bankofamerica.com&s=171.161.207.100 https://www.ssllabs.com/ssltest/analyze.html?d=www.bankofame... https://www.ssllabs.com/ssltest/analyze.html?d=chaseonline.chase.com https://www.ssllabs.com/ssltest/analyze.html?d=chaseonline.c... https://www.ssllabs.com/ssltest/analyze.html?d=online.citibank.com https://www.ssllabs.com/ssltest/analyze.html?d=online.citiba... https://www.ssllabs.com/ssltest/analyze.html?d=us.hsbc.com&s=161.113.4.5 https://www.ssllabs.com/ssltest/analyze.html?d=us.hsbc.com&s... https://www.ssllabs.com/ssltest/analyze.html?d=online.wellsfargo.com&s=159.45.2.70 https://www.ssllabs.com/ssltest/analyze.html?d=online.wellsf... Ideally, Microsoft, Google, Apple, and Firefox would gang up and all disable ciphersuites lacking DHE/ECDHE in their current browsers. Short of that, one browser disabling them would be viewed as "broken" and would lose marketshare.
            • hrjet 13y ago
              Well, the browsers could disable non PFS ciphers by default. When a site doesn't match any PFS cipher list, show a pop-up with a way to add an exception for the site. Much more graceful than a complete switch-over and doesn't require co-ordination from other vendors.
          • 13y ago