Index  | Recent Threads  | Unanswered Threads  | Who's Active  | Guidelines  | Search
 

Quick Go »
No member browsing this thread
Thread Status: Active
Total posts in this thread: 2
[ Jump to Last Post ]
Post new Thread
Author
Previous Thread This topic has been viewed 1515 times and has 1 reply Next Thread
debrouxl
Advanced Cruncher
France
Joined: Dec 31, 2004
Post Count: 61
Status: Offline
Project Badges:
Reply to this Post  Reply with Quote 
Old TLS protocol versions and low-grade TLS ciphers on the WCG website...

It's been years since I posted on the WCG forum :)
I'm not sure that this is the most appropriate section for such reports, but I'm sure moderators will move the topic where it belongs, if necessary.

So... I'm writing because I recently installed the SSLeuth Firefox extension ( https://addons.mozilla.org/en-US/firefox/addon/ssleuth/ ). I have been using it to get some insight into encryption strength on the web sites that I attend... and, well, at 4.9/10, the WCG site receives one of the lowest marks that I've seen so far ;)

This mark is mainly due to:
* lack of TLS 1.1 and 1.2 support. This is confirmed by raising the security.tls.version.min parameter in Firefox's about:config: if set to 2 or higher, the browser refuses to connect to the WCG site, due to lack of common protocols between server and client;
* lack of PFS cipher support (though TLS 1.0 supports several such ciphers): if I disable both RC4 and non-RC4, non-PFS ciphers globally through SSLeuth's popup, I can't reach the WCG site either, again due to lack of common protocols between server and client.

It's true that many other sites on the Internet don't support 21st century ciphers yet (TLS 1.0, the best WCG supports, was published in 1999); however, many users now use browsers with TLS 1.1 and 1.2 support, and could enjoy better ciphers if the server configuration were improved :)
----------------------------------------
[Nov 16, 2014 4:03:04 PM]   Link   Report threatening or abusive post: please login first  Go to top 
Former Member
Cruncher
Joined: May 22, 2018
Post Count: 0
Status: Offline
Reply to this Post  Reply with Quote 
Re: Old TLS protocol versions and low-grade TLS ciphers on the WCG website...

Just because you "could enjoy better ciphers", does not mean it carries any added value. The security policies of WCG as falling under the cover of IBM are extensive, in fact WCG as the only BOINC project utilizes https as first level connection feature. For an introductory on security for members who don't feel safe, read this: http://www.worldcommunitygrid.org/wb/viewInfoAll.do#sec

Some of the statistical data have aged, where 2.2 billion results have now been exchanged and over 1 million runtime years have been contributed. No security violation has ever occurred, but as is IBM policy, never make anyone the wiser. Only share on a "need to know" basis. If you want to sleuth for actual weaknesses, sleuth away. As it is, IBM is way ahead of you with in security assessment "including engaging 'Ethical Hackers' to ensure that the entire system is secure".

Have a safe crunch.

BTW, think the latest (open)SSL was implement in newest BOINC clients since Heartbleed and the like came along.
[Dec 2, 2014 9:51:34 AM]   Link   Report threatening or abusive post: please login first  Go to top 
[ Jump to Last Post ]
Post new Thread