Experts Warn of a Weak Link in the Security of Web Sites

[G_j]

http://www.nytimes.com/2010/08/14/technology/14encrypt.html?_r=1&ref=technology

Experts Warn of a Weak Link in the Security of Web Sites
By MIGUEL HELFT
Published: August 13, 2010


SAN FRANCISCO — Computer security researchers are raising alarms about vulnerabilities in some of the Web’s most secure corners: the banking, e-commerce and other sites that use encryption to communicate with their users.

Those sites, which are typically identified by a closed lock displayed somewhere in the Web browser, rely on a third-party organization to issue a certificate that guarantees to a user’s Web browser that the sites are authentic. But as the number of such third-party “certificate authorities” has proliferated into hundreds spread across the world, it has become increasingly difficult to trust that those who issue the certificates are not misusing them to eavesdrop on the activities of Internet users, the security experts say.

<snip>

According to the Electronic Frontier Foundation, more than 650 organizations can issue certificates that will be accepted by Microsoft’s Internet Explorer and Mozilla’s Firefox, the two most popular Web browsers. Some of these organizations are in countries like Russia and China, which are suspected of engaging in widespread surveillance of their citizens.

Mr. Eckersley said Exhibit No. 1 of the weak links in the chain is Etisalat, a wireless carrier in the United Arab Emirates that he said was involved in the dispute between the BlackBerry maker, Research In Motion, and that country over encryption. The U.A.E. threatened to discontinue some BlackBerry services because of R.I.M.’s refusal to offer a surveillance back door to its customers’ encrypted communications. Mr. Eckersley also said that Etisalat was found to have installed spyware on the handsets of some 100,000 BlackBerry subscribers last year. Research In Motion later issued patches to remove the malicious code.

..more..

[Beam Me Up]

1. Well, I'm so glad

there's no "widespread surveillance of citizens" going on in this country.



:\

[Greyhound]

2. K&R, but also duh.

I'm sure that "nobody's could've predicted" that "verifying authenticity" and shipping sensitive data to third-parties with no accountability, located in country's that are barely less hostile than our enemies, and that for practical purposes have no law beyond the authority of "we say so", might lead to some sort of problem.

[dixiegrrrrl]

3. Just as "no one could have imagined" that millions of online banking accounts

would inspire computer theft.

[G_j]

4. YEP

a very big DUH!