Protocols
TLS 1.3 No
TLS 1.2 Yes
TLS 1.1 Yes
TLS 1.0 Yes
(…)
Forward Secrecy With some browsers (more info)
(…)
Strict Transport Security (HSTS) Invalid Server provided more than one HSTS header
Archiv: Domain Name System Bereich / Webseiten / domains / websites (de / en)
SSL Report: unmissions.org (85.159.207.65)
TLS 1.3 No
TLS 1.2 Yes
TLS 1.1 Yes
TLS 1.0 Yes
SSL Report: unmissions.org (85.159.207.65)
TLS 1.3 No
TLS 1.2 Yes
TLS 1.1 Yes
TLS 1.0 Yes
www.wafa.ps
Verifying you are human. This may take a few seconds………………………………………..
www.nna-leb.gov.lb
Verifying you are human. This may take a few seconds……………………………………………
SPD Sachsen
Hallo. Schön, dass Sie hier sind.
Ich bin Petra Köpping, Spitzenkandidatin der SPD Sachsen zur Landtagswahl. Ich begrüße Sie und euch auf der Website der SPD Sachsen. Hier gibt es alle Informationen zur SPD in Sachsen und natürlich zu den anstehenden Wahlen.
> וודאו שיש לכם TLS 1.3 או TLS 1.2 תחת הסעיף Protocols. עדיף שלא יהיה לכם TLS 1.0\1.1 בכלל. מספר השרתים הפגיעים בישראל: 100,000+ לא פשוט לכתוב אייטם כזה לאנשים לא מקצועיים, אבל הוא חשוב והתפרסם ב @Haaretz
(10 Dec 2019)
אני מודה ל @noamr ו- @GilBahat על ה-peer review
TLS 1.3: Slow adoption of stronger web encryption is empowering the bad guys
(April 6, 2020)
Asymmetric encryption is used during the “handshake”, which takes place prior to any data being sent. The handshake determines which cipher suite to use for the session – in other words, the symmetric encryption type – so that both browser and server agree. The TLS 1.2 protocol took multiple round trips between client and server, while TLS 1.3 is a much smoother process that requires only one trip. This latency saving shaves milliseconds off each connection.
SSL Report: gdl.de (194.231.14.237)
Subject www.dgvb-hessen.de
(…)
TLS 1.3 No
TLS 1.2 Yes
TLS 1.1 Yes
TLS 1.0 Yes
TLS 1.3: Slow adoption of stronger web encryption is empowering the bad guys
(April 6, 2020)
Asymmetric encryption is used during the “handshake”, which takes place prior to any data being sent. The handshake determines which cipher suite to use for the session – in other words, the symmetric encryption type – so that both browser and server agree. The TLS 1.2 protocol took multiple round trips between client and server, while TLS 1.3 is a much smoother process that requires only one trip. This latency saving shaves milliseconds off each connection.
SSL Report: rubikon.news (94.130.169.230)
TLS 1.3 No
TLS 1.2 Yes
TLS 1.1 Yes
TLS 1.0 Yes
TLS 1.3: Slow adoption of stronger web encryption is empowering the bad guys
(April 6, 2020)
Asymmetric encryption is used during the “handshake”, which takes place prior to any data being sent. The handshake determines which cipher suite to use for the session – in other words, the symmetric encryption type – so that both browser and server agree. The TLS 1.2 protocol took multiple round trips between client and server, while TLS 1.3 is a much smoother process that requires only one trip. This latency saving shaves milliseconds off each connection.
SSL Report: unrwa.org (104.18.26.32)
Protocols
TLS 1.3 No
TLS 1.2 Yes
SSL Report: gdl.de (194.231.14.237)
Subject www.dgvb-hessen.de
(…)
TLS 1.3 No
TLS 1.2 Yes
TLS 1.1 Yes
TLS 1.0 Yes
> וודאו שיש לכם TLS 1.3 או TLS 1.2 תחת הסעיף Protocols. עדיף שלא יהיה לכם TLS 1.0\1.1 בכלל. מספר השרתים הפגיעים בישראל: 100,000+ לא פשוט לכתוב אייטם כזה לאנשים לא מקצועיים, אבל הוא חשוב והתפרסם ב @Haaretz
(10 Dec 2019)
אני מודה ל @noamr ו- @GilBahat על ה-peer review
Die 5 großen DNS-Angriffe und wie man sie abwehrt
(9. März 2022)
Die Aufgabe des DNS besteht darin, den Begriff, den Sie in ein Suchfeld eingeben (den so genannten menschenlesbaren Namen), in die entsprechende Zahlenfolge (IP-Adresse) zu übersetzen, die Ihr Gerät benötigt, um auf eine Website zuzugreifen oder eine E-Mail zu senden. Angriffe auf diese unverzichtbaren Systeme können sehr schädlich sein.
‘All systems need to be hardened’: Officials, industry sound the alarm on quantum threat to encryption
(September 29, 2023)
Such an all-conquering computer doesn’t actually exist yet. But there lies the paradox of what’s called quantum-resistant or “post-quantum” encryption: You don’t need a quantum computer to start laying the foundations for a quantum-powered hack — or, fortunately, to start building a defense.
The threat is a tactic called “collect now, decrypt later.” Well-heeled foreign intelligence agencies (and the American NSA) already scoop up terabytes of encrypted communication. Whatever they can’t crack today can just go into long-term storage, waiting for quantum computers to get powerful enough to break them.
> וודאו שיש לכם TLS 1.3 או TLS 1.2 תחת הסעיף Protocols. עדיף שלא יהיה לכם TLS 1.0\1.1 בכלל. מספר השרתים הפגיעים בישראל: 100,000+ לא פשוט לכתוב אייטם כזה לאנשים לא מקצועיים, אבל הוא חשוב והתפרסם ב @Haaretz
(10 Dec 2019)
אני מודה ל @noamr ו- @GilBahat על ה-peer review
TLS 1.3: Slow adoption of stronger web encryption is empowering the bad guys
(April 6, 2020)
Asymmetric encryption is used during the “handshake”, which takes place prior to any data being sent. The handshake determines which cipher suite to use for the session – in other words, the symmetric encryption type – so that both browser and server agree. The TLS 1.2 protocol took multiple round trips between client and server, while TLS 1.3 is a much smoother process that requires only one trip. This latency saving shaves milliseconds off each connection.
US-Geheimdienste: Lizenz zur weltweiten Überwachung läuft aus
Dass besagte Section 702 verlängert wird, steht kaum außer Frage.
Citing cyber investigations, officials ask Congress to renew surveillance powers
(14.06.2023)
In a joint written testimony from the Biden administration witnesses, the NSA, FBI and CIA all cited Section 702’s usefulness for cybersecurity.
US intelligence community presses for FISA Section 702 reauthorization
(13.06.2023)
Officials from U.S. intelligence agencies backed reauthorization of Section 702 of the Foreign Intelligence Surveillance Act ahead of a U.S. Senate subcommittee hearing Tuesday. One official characterized a potential lapse or „unusable“ modifications to Section 702 as „grave national security risks.“ The support for full reauthorization came as 21 advocacy groups joined on a letter urging reform of Section 702. Meanwhile, the Office of the Director of National Intelligence issued a report regarding purchases of commercially available personal information by the U.S. intelligence community.
„Albtraumszenario“: US-Dienste kaufen massenhaft Handydaten für Überwachung
„Der Regierung wäre es nie erlaubt worden, Milliarden Menschen dazu zu verpflichten, jederzeit Geräte zur Standortüberwachung bei sich zu haben, ihre sozialen Interaktionen aufzuzeichnen oder lückenlose Aufzeichnungen ihrer Lesegewohnheiten vorzuhalten“, fasst das Office of the Director of National Intelligence zusammen. Doch Smartphones, vernetzte Fahrzeugen, Webtracking, das Internet der Dinge und „andere Innovationen“ hätten die gleichen Folgen, ohne dass die Regierung etwas tun müsse.
Bestätigt: US-Geheimdienste kaufen persönliche Daten – Datenschutzbedenken wachsen
Die Art und Weise, wie US-Geheimdienste Daten aus verbundenen Fahrzeugen, Webbrowser-Aktivitäten und Smartphones sammeln und nutzen, steht zunehmend im Fokus. Dabei besteht die Gefahr, dass die unregulierte Verbreitung und der Verkauf von privaten Informationen amerikanischer Bürgerinnen und Bürger deren Privatsphäre bedroht. Der Bericht wurde vom Büro des Direktors der nationalen Geheimdienste (ODNI) veröffentlicht.
In response to my request, DNI Haines has confirmed that the government is buying Americans‘ private data with no guardrails for when and how that data is used. If this isn‘t a wake up call for Congress to stop feds from buying up Americans‘ information, I don‘t know what is.
Office of the Director of National Intelligence Senior Advisory Group Panel on Commercially Available Information
(27 January 2022, approved for release by ODNI on 5 June 2023)
(U) EXECUTIVE SUMMARY
(U) There is today a large and growing amount of what the U.S. Intelligence Community (IC) refers to as “Commercially Available Information” (CAI). As the acronym indicates, and as we use the term in this report, CAI is information that is available commercially to the general public, and as such, is a subset of publicly available information (PAI). We do not use the term CAI to include, and we do not address in this report, commercial information that is available exclusively to governments. The volume and sensitivity of CAI have expanded in recent years mainly due to the advancement of digital technology, including location-tracking and other features of smartphones and other electronic devices, and the advertising-based monetization models that underlie many commercial offerings available on the Internet. Although CAI may be “anonymized,” it is often possible (using other CAI) to deanonymize and identify individuals, including U.S. persons.
(…)
Today, in a way that far fewer Americans seem to understand, and even fewer of them can avoid, CAI includes information on nearly everyone that is of a type and level of sensitivity that historically could have been obtained, if at all, only through targeted (and predicated) collection, and that could be used to cause harm to an individual’s reputation, emotional well-being, or physical safety.
(…)
(U) A May 2014 report from the Federal Trade Commission (FTC) provides a similar account:
(U) Data brokers collect data from commercial, government, and other publicly available sources. Data collected could include bankruptcy information, voting registration, consumer purchase data, web browsing activities, warranty registrations, and other details of consumers’ everyday interactions.
(…)
1.3. (U) Examples of CAI. We do not attempt a comprehensive description of the scope and scale of data that are available as CAI, or the relevant markets, in part because they are so large and so dynamic. However, a few examples of CAI offerings will illustrate the current nature of available offerings:
• (U) “Thomson Reuters CLEAR is powered by billions of data points and leverages cutting-edge public records technology to bring all key content together in a customizable dashboard.”
• (U) LexisNexis offers more than “84B records from 10,000+ sources, including alternative data that helps surface more of the 63M unbanked/underbanked U.S. adults.”
• (U) Exactis has “over 3.5 billion records (updated monthly)” in its “universal data warehouse.”
• (U) PeekYou “collects and combines scattered content from social sites, news sources, homepages, and blog platforms to present comprehensive online identities.”
(…)
As the FTC explained in its May 2014 report:
(U) Data brokers rely on websites with registration features and cookies to find consumers online and target Internet advertisements to them based on their offline activities. Once a data broker locates a consumer online and places a cookie on the consumer’s browser, the data broker’s client can advertise to that consumer across the Internet for as long as the cookie stays on the consumer’s browser. Consumers may not be aware that data brokers are providing companies with products to allow them to advertise to consumers online based on their offline activities. Some data brokers are using similar technology to serve targeted advertisements to consumers on mobile devices.
(…)
2.2. (U) Examples of CAI Contracts. The IC currently acquires a large amount of CAI. Unclassified IC and other contracts for CAI can be found at Sam.Gov, a U.S. government website that allows searching by agency or sub-agency and by keywords, among other things. By way of example only, this website shows that the following agencies have, have had, have considered, or are considering the following contracts or proposals related to CAI:
• (U) The Federal Bureau of Investigation (FBI) with ZeroFox for social media alerting (15F06721P0002431)
• (censored)
• U) The Defense Intelligence Agency (DIA) for social media reports on individuals who are seeking a security clearance (HHM402-16-SM-CHECKS), and with LexisNexis for “retrieval of comprehensive on-line search results related to commercial due diligence from a maximum number of sources (news, company, public records, legal, regulatory financial, and industry information),” among other things (HHM402-21-Q-0094)
• (U) The U.S. Navy with Sayari Analytics, Inc. for access to its database that “contains tens of thousands of previously-unidentified specific nodes, facilities and key people related to US sanctioned actors including ‘2+3’ threats to national security” (N0001518PR11212)
• (U) Various offices within the Treasury Department for access to Banker’s Almanac (RFQ-FIN-55100-21-0010)
• (U) The Department of Defense (DOD) for access to Jane’s online (W31P4Q17T0009)
• (U) The Coast Guard with Babel Street for “Open Source Data Collection, Translation, Analysis Application” (70Z08419QVA044).
(U) In addition, DIA has provided the following information about a CAI contract in an unclassified and publicly-available paper sent to Congress on January 15, 2021:
(U) DIA currently provides funding to another agency that purchases commercially available geolocation metadata aggregated from smartphones.
……………………………………
US intelligence agencies buy Americans’ personal data, new report says
The report was completed in January 2022 but only recently declassified. Democratic Sen. Ron Wyden of Oregon asked the ODNI for the report.
“Congress needs to pass legislation to put guardrails around government purchases, to rein in private companies that collect and sell this data, and keep Americans’ personal information out of the hands of our adversaries,” Wyden said in a statement Monday in response to the report.
The race to save the Internet from quantum hackers
(08 February 2022)
Rent or buy this article
Get just this article for as long as you need it
$39.95
TLS 1.3: Slow adoption of stronger web encryption is empowering the bad guys
(April 6, 2020)
Asymmetric encryption is used during the “handshake”, which takes place prior to any data being sent. The handshake determines which cipher suite to use for the session – in other words, the symmetric encryption type – so that both browser and server agree. The TLS 1.2 protocol took multiple round trips between client and server, while TLS 1.3 is a much smoother process that requires only one trip. This latency saving shaves milliseconds off each connection.
Europe’s Moral Crusader Lays Down the Law on Encryption
Arrayed against her is a fierce coalition of privacy advocates, American YouTubers, German soccer fans, and tech executives who argue that the proposal would severely impact online privacy. They call it the “chat control” bill and warn that it would open dangerous backdoors into encrypted apps. Because Johansson has made herself the face of this bill, criticism is lobbed at her personally. “Either she’s stupid or she’s evil,” says Jan Jonsson, CEO of Swedish VPN service Mullvad. In February, she was given a dubious “prize” at the Dutch Big Brother Awards, an event organized by digital rights group Bits of Freedom, which identifies heroes and villains in the fight for privacy.
G7 calls for developing global technical standards for AI
The agreement came after the European Union, which participates in the G7, inched closer this month to passing legislation to regulate AI technology, potentially the world‘s first comprehensive AI law that could form a precedent among the advanced economies.
„We want AI systems to be accurate, reliable, safe and non-discriminatory, regardless of their origin,“ European Commission President Ursula von der Leyen said on Friday.
Live-Überwachung: Mehrheit der EU-Staaten drängt auf Audio-Chatkontrolle
(17.95.2023)
Eine solche Ausweitung der von der EU-Kommission geplanten „Aufdeckungsanordnungen“ für Provider auch auf gesprochene Kommunikation dürfte sehr weitreichende Folgen haben. So könnten etwa neben Sprachnachrichten über Messenger-Dienste auch auf Online-Anrufbeantwortern hinterlassene Botschaften oder Telefonanrufe umfasst sein.
Chatkontrolle: Justizminister Buschmann mobilisiert EU-Kolleg:innen
Zusammen mit vier Amtskolleg:innen aus Liechtenstein, Luxemburg, Österreich und Schweiz hat Bundesjustizminister Marco Buschmann einen Brief an die Justizminister:innen der EU-Länder geschrieben. Sie sollen sich gegen die Chatkontrolle in die Diskussion einbringen – auch wenn die Innenministerien die Verhandlung führen. Wir veröffentlichen den Brief im Volltext.
EU-Beitritt oder Freihandelsabkommen – das wären die Folgen für die Schweiz
(28. Februar 2023)
Eine neue Studie zeigt nun, was der Schweiz ein Freihandelsabkommen, eine Drittstaatenregelung oder ein kompletter Beitritt bringen würde. Die Studie kommt vom Institut für Schweizer Wirtschaftspolitik in Luzern, vom Kiel Institut für Weltwirtschaft und vom österreichischen Wirtschaftsforschungsinstitut in Wien.
Trotz Neutralität: Schweiz erwägt Beitritt zu EU-Verteidigungsprojekten
(04.05.2023)
Cyberangriffe seien eines der Instrumente, die für „Wettbewerb, Einschüchterung und Zwang“ eingesetzt werden, so die EU in ihrer im vergangenen Jahr veröffentlichten Sicherheitsstrategie, die darauf hinwies, dass „in den letzten Jahren die klassische Unterscheidung zwischen Krieg und Frieden immer mehr abnimmt.“
Auch die NATO hat den Cyberspace zu einem Bereich erklärt, in dem ein gewisses Maß an Angriffen als Bedrohung definiert werden könnte und ein Mitglied des Militärbündnisses dazu veranlassen könnte, sich auf die Klausel der kollektiven Verteidigung nach Artikel 5 zu berufen.
Gutachten des EU-Ministerrats: Verdachtslose Chatkontrolle ist zum Scheitern verurteilt
Das offizielle Gutachten des Juristischen Dienstes des EU-Ministerrats über die Rechtmäßigkeit der vorgeschlagenen Verordnung über sexuellen Kindesmissbrauch (CSAR), auch Chatkontrolle genannt, wurde geleakt. Es stellt fest, dass die geplante verdachtslose Chatkontrolle samt Ausleitung an eine EU-Behörde grundrechtswidrig ist. (…)
„Nach der vernichtenden Kritik der eigenen Berater wird es zunehmend einsam um Bundesüberwachungsministerin Faeser, die illegale verdachtslose Chatkontrollen bei unverschlüsselten E-Mails, Nachrichten und Chats ausdrücklich unterstützt. Ihre Position ist mit dem offiziellen Ratsgutachten endgültig unhaltbar geworden, denn niemand hilft Kindern mit einer Verordnung, die unweigerlich vor dem Europäischen Gerichtshof scheitern wird.
> וודאו שיש לכם TLS 1.3 או TLS 1.2 תחת הסעיף Protocols. עדיף שלא יהיה לכם TLS 1.0\1.1 בכלל. מספר השרתים הפגיעים בישראל: 100,000+ לא פשוט לכתוב אייטם כזה לאנשים לא מקצועיים, אבל הוא חשוב והתפרסם ב @Haaretz
(10 Dec 2019)
אני מודה ל @noamr ו- @GilBahat על ה-peer review
Cooper Davis Act: US-Senat nimmt Drogen-Chats ins Visier
Anbieter können in ihrem Bericht an die DEA nach eigenem Ermessen entscheiden, welche Informationen sie weitergeben. Gleichzeitig enthält der Gesetzentwurf aber auch eine Liste mit Informationen, die einem solchen Bericht beiliegen sollten. Dazu gehören etwa Mail- und IP-Adressen, Zahlungsinformationen, der geographische Standort sowie ein kompletter Auszug der betreffenden Inhalte. Diese Informationen kann die DEA dann auch an andere Strafverfolgungsbehörden weiterleiten.
Die Daten sollen nicht nur weitergegeben, sondern auch vom Provider an einem „sicheren Ort“ für 90 Tage nach Einreichung bei der DEA gespeichert werden. Im Gesetzentwurf ist jedoch auch vermerkt, dass die DEA eine Verlängerung der Speicherung beantragen kann, wenn sie beabsichtigt, gegen Nutzer*innen zu ermitteln oder die Daten an andere Behörden weiterzuleiten.
Nutzer*innen wissen derweil nichts von der Weiterleitung ihrer Daten.
Cooper Davis Act: Another Attempt By Congress To Regulate That Which They Don’t Understand
In many ways, this is similar to the CyberTipline for CSAM that requires websites to report details if they come across child sexual abuse material. But, CSAM is strict liability content for which there is no 1st Amendment protection. Demanding that anything even remotely referencing an illegal drug transaction be sent to the DEA will sweep up a ton of perfectly protected speech.
Worse, it will lead to massive overreporting of useless leads. I’ve mentioned just recently that we get a ton of attempted spam comments here at Techdirt, over a million in just the last six months alone. A decent percentage of these appear to be pushing what are likely to be illegal drugs. Now, we catch the vast majority of these in the spam filter, and they never reach the site. And, I don’t think a mere spam comment alone would reach the level of knowledge necessary to trigger this law, but the point is that there’s potential that our lawyers would warn us that to protect ourselves from potentially ruinous liability for failing to report these spam messages to the DEA, they’d recommend we basically flood the DEA with a bunch of the spam messages we received just to avoid the risk of liability.