{"id":4062,"date":"2011-01-24T18:55:48","date_gmt":"2011-01-24T23:55:48","guid":{"rendered":"http:\/\/rbachnet.wwwmi3-ss40.a2hosted.com\/?p=4062"},"modified":"2022-12-30T15:53:00","modified_gmt":"2022-12-30T20:53:00","slug":"social-media-sites-implement-ssl","status":"publish","type":"post","link":"https:\/\/rbach.net\/index.php\/social-media-sites-implement-ssl\/","title":{"rendered":"Social Media Sites Implement SSL"},"content":{"rendered":"

\"Social<\/a>In the wake of the October 2010 release of Firesheep<\/a> many social media websites are stepping up their security. Firesheep is a simple-to-use user account hijacking tool that can give attackers temporary full access to accounts from many of the most popular social media websites.\u00a0 Social media sites like Facebook<\/a> (FB<\/a>), Twitter<\/a>, Gmail<\/a>, Hotmail<\/a>, Flickr<\/a>, and WordPress<\/a>, have begun to add full end-to-end encryption.<\/p>\n

George Ou at Digital Society<\/a><\/em> tracks<\/a> SSL<\/a> implementations on websites and has created an online services report card. The report card grades the way that social media sites implement full end-to-end encryption, and what generic protocols are deemed safe. The latest report card looks like this:<\/p>\n

\"SSL<\/a><\/p>\n

\"SSL<\/a>The table from Digital Society<\/em> indicated that only Gmail.com and WordPress free hosting site get an “A” and are fully impervious to partial and full sidejacking<\/a> and full hijacking<\/a> of HTTP sessions. The report card gives Facebook, Twitter, and Microsoft’s<\/a> (MSFT<\/a>) Hotmail failing grades. The bottom part of the table refers to generic protocols that are commonly used by computers and smartphones. The majority of devices use unsafe versions of protocols according to Digital Society<\/em>.<\/p>\n

Microsoft has announced the general availability of the full-session SSL (HTTPS). The security upgrade has also been applied to other Live services<\/a>,\u00a0 including SkyDrive<\/a>, Photos<\/a>, and Devices<\/a>. MSFT says to activate full session SSL (I recommend you do, especially if you ever access these services on public or shared computers<\/em>), head on over to account.live.com\/ManageSSL. After completing their form SSL is activated and all future Web connections will be protected.\u00a0 It’s important to note, however, that flipping the SSL switch means you won’t be able to reach your Hotmail via Windows Live Mail (desktop), the Outlook Hotmail connector, or the Windows Live app for Windows Mobile 6.5 and Symbian.<\/p>\n

The latest Google site to support\u00a0 SSL-encrypted connections is Google’s Picasa Web<\/a>. As with many other sites, though, not everything displayed on Picasa Web is encrypted. While the home page and upload form are fully encrypted, gallery pages report as being only partly encrypted. The Google Operating System blog<\/a> says<\/a> that many Google services now support HTTPS connections: Gmail (enabled by default), Google Reader, Google Groups, Picasa Web Albums<\/a>, Google Search, Google Finance, YouTube<\/a> (partly encrypted). Other services only support encrypted connections: Google Calendar, Google Docs, Google Sites, Google Health, Google Analytics, Google AdSense and AdWords, Google Web History<\/a>, Google Bookmarks, Google Voice, Google Latitude, Google Checkout.<\/p>\n

rb-<\/em><\/strong><\/p>\n

\"HTTPS<\/a>Even average users are a bit more in-tune when it comes to security and privacy on the Web today (thanks in part to the recent Firesheep threats). There’s a simple solution: browse using HTTPS when possible<\/a>. The easiest way to do that is to use Mozilla Firefox<\/a> and the HTTPS Everywhere<\/a> from the EFF<\/a>, which I use and wrote about here<\/a>.<\/em><\/p>\n

Related articles<\/h6>\n