News for hackers. Stuff that matters.

A comment on Lavabit SSL Cert Revoked. Parent comment

Re:Lavabit SSL Cert Revoked by enaeseth on Tuesday October 08, 2013 @05:30PM (#6517972)
Will having the private key allow the decryption of ciphertext that was previously intercepted (while the service was active) and stored? Lavabit was already shut down, so this revocation is equally useless for user security. :(
[ Parent | on HN ]
Re:Lavabit SSL Cert Revoked by bcoates on Tuesday October 08, 2013 @05:37PM (#6518001)
If the connection was using a forward-secret key exchange (like DHE or ECDHE), then no. Unfortunately it's common not to and browsers don't do anything to warn people that they're using a low-security mode.
[ Parent | on HN ]
Re:Lavabit SSL Cert Revoked by Amadou on Tuesday October 08, 2013 @05:45PM (#6518043)
FWIW, just now I went looking for a firefox plugin that reports (in a human-friendly way) whether or not the SSL connection for a page is using perfect forward secrecy (PFS).

I found "Calomel SSL Validation," which I am about to install. The PFS reporting only works with Firefox 25 and up.

https://addons.mozilla.org/en-US/firefox/addon/calomel-ssl-v...

[ Parent | on HN ]
Re:Lavabit SSL Cert Revoked by davidism on Tuesday October 08, 2013 @11:31PM (#6519254)
Thanks for finding this. Calomel's website [1] gives much more information about how the scoring is done as well as security in general; very interesting.

[1] https://calomel.org/firefox_ssl_validation.html

[ Parent | on HN ]
Re:Lavabit SSL Cert Revoked by mstrem on Tuesday October 08, 2013 @10:15PM (#6519071)
Also the Netcraft Extension gives you this information: http://news.netcraft.com/archives/2013/09/06/perfect-forward...
[ Parent | on HN ]
Re:Lavabit SSL Cert Revoked by sdfjkl on Wednesday October 09, 2013 @09:08AM (#6520979)
Sadly it comes with an awful toolbar.
[ Parent | on HN ]
Re:Lavabit SSL Cert Revoked by porges on Tuesday October 08, 2013 @05:39PM (#6518006)
It depends on what ciphersuite was being used for the particular session. Some offer forward secrecy, but not all.
[ Parent | on HN ]