http://simonwillison.net/2018-07-06T23:02:43+00:00Simon Willison2018-07-06T23:02:43+00:002018-07-06T23:02:43+00:00https://simonwillison.net/2018/Jul/6/james-donohue/#atom-tag

<blockquote cite="https://medium.com/bbc-design-engineering/bbc-news-on-https-182b45ef60c"><p>Over the last twenty years, publishing systems for content on [BBC] News pages have come and gone, having been replaced or made obsolete. Although newer content is published through dynamic web applications that can be readily modified, what lies beneath this sometimes resembles layers of sedimentary rock.</p></blockquote> <p class="cite">&mdash; <a href="https://medium.com/bbc-design-engineering/bbc-news-on-https-182b45ef60c">James Donohue</a></p> <p>Tags: <a href="https://simonwillison.net/tags/bbc">bbc</a>, <a href="https://simonwillison.net/tags/bbcnews">bbcnews</a>, <a href="https://simonwillison.net/tags/ssl">ssl</a></p>

2018-03-19T22:21:57+00:002018-03-19T22:21:57+00:00https://simonwillison.net/2018/Mar/19/hsts-abuse/#atom-tag

<p><strong><a href="https://webkit.org/blog/8146/protecting-against-hsts-abuse/">Protecting Against HSTS Abuse</a></strong></p> Any web feature that can be used to persist information will eventually be used to build super-cookies. In this case it’s HSTS—a web feature that allows sites to tell browsers “in the future always load this domain over HTTPS even if the request specified HTTP”. The WebKit team caught this being exploited in the wild, by encoding a user identifier in binary across 32 separate sub domains. They have a couple of mitigations in place now—I expect other browser vendors will follow suit. <p><small></small>Via <a href="https://twitter.com/troyhunt/status/975816855838384128?s=21">@troyhunt</a></small></p> <p>Tags: <a href="https://simonwillison.net/tags/privacy">privacy</a>, <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/ssl">ssl</a>, <a href="https://simonwillison.net/tags/webkit">webkit</a></p>

2017-11-21T14:44:56+00:002017-11-21T14:44:56+00:00https://simonwillison.net/2017/Nov/21/ssl-issuer-popularity/#atom-tag

<p><strong><a href="https://nettrack.info/ssl_certificate_issuers.html">SSL Issuer Popularity</a></strong></p> The impressive growth of Let’s Encrypt in one graph: from 4.87% of TLS-enabled domains in May 2016 to 36.68% in November 2017. <p>Tags: <a href="https://simonwillison.net/tags/domains">domains</a>, <a href="https://simonwillison.net/tags/ssl">ssl</a></p>

2010-03-23T16:24:02+00:002010-03-23T16:24:02+00:00https://simonwillison.net/2010/Mar/23/sidechannel/#atom-tag

<p><strong><a href="http://www.freedom-to-tinker.com/blog/felten/side-channel-leaks-web-applications">Side-Channel Leaks in Web Applications</a></strong></p> Interesting new security research. SSL web connections encrypt the content but an attacker can still see the size of the HTTP requests going back and forward—which can be enough to extract significant pieces of information, especially in applications that make a lot of Ajax requests. <p>Tags: <a href="https://simonwillison.net/tags/ajax">ajax</a>, <a href="https://simonwillison.net/tags/http">http</a>, <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/sidechannel">sidechannel</a>, <a href="https://simonwillison.net/tags/ssl">ssl</a></p>

2008-12-30T15:27:33+00:002008-12-30T15:27:33+00:00https://simonwillison.net/2008/Dec/30/fake/#atom-tag

<p><strong><a href="http://www.freedom-to-tinker.com/blog/felten/researchers-show-how-forge-site-certificates">Researchers Show How to Forge Site Certificates</a></strong></p> Use an MD5 collision to create two certificates with the same hash, one for a domain you own and another for amazon.com. Get Equifax CA to sign your domain’s certificate using the outdated “MD5 with RSA” signing method. Copy that signature on to your home-made amazon.com certificate to create a fake certificate for Amazon that will be accepted by any browser. <p>Tags: <a href="https://simonwillison.net/tags/collisions">collisions</a>, <a href="https://simonwillison.net/tags/ed-felten">ed-felten</a>, <a href="https://simonwillison.net/tags/equifaxca">equifaxca</a>, <a href="https://simonwillison.net/tags/hashes">hashes</a>, <a href="https://simonwillison.net/tags/md5">md5</a>, <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/ssl">ssl</a></p>

2008-06-10T23:49:34+00:002008-06-10T23:49:34+00:00https://simonwillison.net/2008/Jun/10/tls/#atom-tag

<p><strong><a href="http://tlsreport.layer8.net/">the tls report</a></strong></p> Clever service that analyses a web server’s SSL implementation and grades it based on things like the protocols, certificates, ciphers and key lengths it supports. Includes public reports on the top and bottom 20 sites. <p><small></small>Via <a href="http://radar.oreilly.com/archives/2008/06/tlsreport-grade-report-website-security.html">O&#x27;Reilly Radar</a></small></p> <p>Tags: <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/ssl">ssl</a>, <a href="https://simonwillison.net/tags/tls">tls</a></p>

2007-04-17T15:40:40+00:002007-04-17T15:40:40+00:00https://simonwillison.net/2007/Apr/17/janrain/#atom-tag

<p><strong><a href="http://janrain.com/blog/2007/04/17/myopenid-launches-secure-authentication-helps-prevent-phishing/">MyOpenID relaunches</a></strong></p> Now with a handsome redesign and support for SSL client certificates as a secure alternative to passwords. <p>Tags: <a href="https://simonwillison.net/tags/janrain">janrain</a>, <a href="https://simonwillison.net/tags/myopenid">myopenid</a>, <a href="https://simonwillison.net/tags/openid">openid</a>, <a href="https://simonwillison.net/tags/ssl">ssl</a></p>

2007-02-22T12:01:58+00:002007-02-22T12:01:58+00:00https://simonwillison.net/2007/Feb/22/prooveme/#atom-tag

<p><strong><a href="http://prooveme.com/">prooveme.com</a></strong></p> An OpenID provider that uses SSL client certificates (which you install in your browser) for authentication. <p>Tags: <a href="https://simonwillison.net/tags/certificates">certificates</a>, <a href="https://simonwillison.net/tags/openid">openid</a>, <a href="https://simonwillison.net/tags/prooveme">prooveme</a>, <a href="https://simonwillison.net/tags/ssl">ssl</a></p>

2002-07-24T13:06:01+00:002002-07-24T13:06:01+00:00https://simonwillison.net/2002/Jul/24/windowsSslSupportInPython/#atom-tag

<p>Adding <acronym title="Secure Socket Layer">SSL</acronym> support to Python on Windows is as easy as dropping a couple of <acronym title="Dynamic Link Libraries">DLLs</acronym> and a <code>.pyd</code> file in to your Python DLLs directory. Grab the zip file from <a href="http://www.cs.fhm.edu/~ifw00065/pyssl/" title=" Python - SSL">this page</a> and off you go. I haven't tried it out yet but it appears to work - the <a href="http://www.python.org/doc/lib/module-socket.html#l2h-1866">socket.ssl</a> function miraculously appeared when I installed the new files. Why is this useful? Because it opens the way for secure <acronym title="exTensible Markup Language - Remote Procedure Calling">XML-RPC</acronym> calls from Python applications...</p> <p>Tags: <a href="https://simonwillison.net/tags/python">python</a>, <a href="https://simonwillison.net/tags/ssl">ssl</a></p>