Zero-day flaw found in web encryption
Summary: A zero-day flaw in the TLS and SSL protocols, which are commonly used to encrypt web pages, has been made public.
Ray, who along with Dispensa works for two-factor authentication company PhoneFactor, explained in a blog post on Thursday that he had initially discovered the flaw in August, and demonstrated a working exploit to Dispensa at the beginning of September.
The flaw in the TLS authentication process allows an outsider to hijack a legitimate user's browser session and successfully impersonate the user, the researchers said in a technical paper.
For more, read "Zero-day flaw found in web encryption " on ZDNet UK.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
Bad one
because of an incomplete spec) there is no
obvious solution which will not risk breaking a
lot of software.
On the positive side, the vuln can only be
exploited by someone on the network path (it is
a man-in-the-middle attack), which means that
your network admin, the admins at your ISP (and
intelligence services) etc. can use this to
snoop on traffic, but a malicious site can not.
wireless too
Cue...
PS: It's a bad one... I hope it will be fixed even if the possibility of exploitation is low.
A true cross-platform flaw