Security/Encryption - Is this website secure? - Tilted Forum Project Discussion Community

cowudders14 · 08-30-2005, 11:19 AM

Hi,

I need help understanding security etc.

This website: https://secure.firenet.uk.net/signup...band/index.asp gives a security error when viewed in Opera (8.02):

Quote:

Your communication with the server secure.firenet.uk.net is encrypted, but the presented certificate had errors:
An insecure encryption level was requested by the server.
Sending sensitive information through this connection is not safe!

Opera tells me the encryption protocal is "TLS v1.0 128 bit ARC4 (512 bit RSA/MD5)". Now, that's meaningless to me, but having a message such as "this website is not secure" pop up worries me. The admin of the site tells me it's perfectly secure and they pay a handsome sum to Thawte each year for it. So, which/who is right?

Help!

Thanks all!

Slavakion · 08-30-2005, 11:20 AM

I had no problems in Firefox or IE. Maybe Opera's trying to be a lot stricter about security.

Redlemon · 08-30-2005, 11:24 AM

Firefox* tells me that it is "High-grade Encryption (RC4 128 bit)", verified by Thawte. Sounds like Opera is mis-identifying the encryption. Firefox also will warn if a website is mixed encryption, and I didn't get a warning on that either.

*actually Deer Park, I run the nightly builds

cowudders14 · 08-30-2005, 11:28 AM

How would opera mis-identify the encryption? Sorry again - I've no idea how to interperet it, but surely it's either secure to a high level or not. Is it possibly a bug in Opera that means it isn't happy to talk to the website at the higher level, so the website drops the encyption level to one it is happy to use, which Opera then tells me is unsafe? Or have I got the wrong end of the stick there?

Thanks!

Redlemon · 08-30-2005, 12:18 PM

Ah, got it. Here's a link from the My Opera Forums. The error is supposed to read "The site is using an outdated encryption method", but there was a last-minute bug.

One thing that trips this message is a "RSA/DH keys shorter than 900 bits", and this one is only 512 bits.

Quote:

Several years ago a 512 bit RSA key was broken in, effectively, 10-12 weeks (they used 7-8 months computing by night on a few hundred workstations). Today the same job could probably be done in less than 4 weeks, possibly much less depending on how many computers you throw at it, and other improvements in the art of factoring large numbers). Since such a key is usually used for at least one year that means that keys of this length was no longer adequate protection for any information that needed to be kept secure for more than a few weeks.

I'd say, you are probably OK using this website. You might want to send the above link to the site admin for his comment, however.

cowudders14 · 08-31-2005, 01:47 PM

Many thanks Redlemon - I'll get back to the admin and see what he says. That thread from opera forums will be very useful in explaining. Cheers!

Jinn · 09-02-2005, 12:23 PM

Quote:

As of 2005, the largest number factored by general-purpose methods was 663 bits long, using state-of-the-art distributed methods. RSA keys are typically 1024–2048 bits long. Some experts believe that 1024-bit keys may become breakable in the near term (though this is disputed); few see any way that 4096-bit keys could be broken in the foreseeable future. Therefore, it is generally presumed that RSA is secure if n is sufficiently large. If n is 256 bits or shorter, it can be factored in a few hours on a personal computer, using software already freely available. If n is 512 bits or shorter, it can be factored by several hundred computers as of 1999. A theoretical hardware device named TWIRL and described by Shamir and Tromer in 2003 called into question the security of 1024 bit keys. It is currently recommended that n be at least 2048 bits long.

Honestly, 512-bit RSA keys are secure enough for anything non-corporate or non-government. However, in the next few years this may change. If you're really looking for an explanation of RSA (it's a really neat method for encryption) check out: http://en.wikipedia.org/wiki/Rsa

cowudders14 · 09-03-2005, 09:40 AM

Interesting read! Thanks!

08-30-2005, 11:24 AM	#3 (permalink)
Redlemon Devoted Donor Location: New England	Firefox* tells me that it is "High-grade Encryption (RC4 128 bit)", verified by Thawte. Sounds like Opera is mis-identifying the encryption. Firefox also will warn if a website is mixed encryption, and I didn't get a warning on that either. *actually Deer Park, I run the nightly builds __________________ I can't read your signature. Sorry.

08-30-2005, 11:28 AM	#4 (permalink)
cowudders14 Bringer of good Moos... Location: Midlands, UK	How would opera mis-identify the encryption? Sorry again - I've no idea how to interperet it, but surely it's either secure to a high level or not. Is it possibly a bug in Opera that means it isn't happy to talk to the website at the higher level, so the website drops the encyption level to one it is happy to use, which Opera then tells me is unsafe? Or have I got the wrong end of the stick there? Thanks! __________________ Moo! I'm mooey!

08-31-2005, 01:47 PM	#6 (permalink)
cowudders14 Bringer of good Moos... Location: Midlands, UK	Many thanks Redlemon - I'll get back to the admin and see what he says. That thread from opera forums will be very useful in explaining. Cheers! __________________ Moo! I'm mooey!

09-03-2005, 09:40 AM	#8 (permalink)
cowudders14 Bringer of good Moos... Location: Midlands, UK	Interesting read! Thanks! __________________ Moo! I'm mooey!

08-30-2005, 11:20 AM	#2 (permalink)
Slavakion Mjollnir Incarnate Location: Lost in thought	I had no problems in Firefox or IE. Maybe Opera's trying to be a lot stricter about security.