+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: SSL Poodle Exploit (/showthread.php?tid=4494963)
SSL Poodle Exploit - Omniscient - Oct 17, 2014
https://www.openssl.org/~bodo/ssl-poodle.pdf
Some of you might be paying attention to these rather publicized exploits but some may not. In either case the latest exploit bug in SSL was released about a week ago and labeled "Poodle" which stands for "Padding Oracle On Downgraded Legacy Encryption".
It's basically a MITM exploit. Not really easy to take advantage of but considering this is now the 2nd time a huge SSL exploit was published I just wonder why members still send me requests for us to add SSL.
It's imho very dangerous to falsely assume your safe because your browser has a little lock icon. You should be relying on your own knowledge and your own connection for your own security.
We may one day add SSL/TLS to the site. Not sure when if ever but it might come. I just don't see why members are pushing for it at a time when SSL has been cracked twice. And I've not once had an account stolen via MITM.
We're more in need of other security options for accounts beyond an SSL connection like 2FA. Which I am currently working on.
Thanks everyone and enjoy.
* - Dr.Cooper - Oct 17, 2014
Thanks for the awesome info. Reading it right now Omni! :) Cheers!
* - Cyba - Oct 17, 2014
Adding SSL to a large site is a pain in the ass, speaking from personal experience. So many things you need to fix manually, not just installing the cert and editing htaccess.
* - Aura - Oct 17, 2014
Saw this yesterday. Google and Mozilla are supposed to adjust their browsers to make them more secure to use and prevent that exploit from hitting them but for now all of them (browsers) are vulnerable.
* - Fox™ - Oct 17, 2014
This is sad, and adding SSL to large sites, as stated above is a pain. I'm excited for 2FA though. c:
* - Wafflemonger - Oct 17, 2014
Yeah, I remember reading this last week and thinking the exact same thing, "Won't really be an issue for most networks out there unless there's a disgruntled employee or no one notices someone sitting there with a laptop for hours on end."
* - Inkling - Oct 17, 2014
Poodle's a rather old exploit, isn't it?
I remember reading about this exploit like a year ago.
* - Tuna - Oct 17, 2014
Glad to see you upgrading the website!
* - Tony Stark - Oct 17, 2014
Hopefully this provides answers to those pushy people.
Been waiting patiently for 2FA. Hopefully members will be at peace knowing their accounts will be more secure and their security is more in their control once it's implemented.
* - Omniscient - Oct 17, 2014
I like how the easy fix is as simple as "disable ssl". :)
* - Autopost - Oct 17, 2014
To be honest I just cant wait until 2FA, that's when I'll be happy.
* - ZuGgY - Oct 17, 2014
Oh damn, first Heartbleed and now this? o_O
* - Blazin - Oct 17, 2014
Wow more SSL shit being exposed wonderful.
* - Rote - Oct 17, 2014
Really glad that we got someone like you mate,
keeping yourself updated so we stay safe. :)
* - Omniscient - Oct 17, 2014
I actually spend a fair amount of time as a system admin for HF. It's time members are not aware I'm spending working for the most part. Whether it's toying around with settings, updating services, or increasing security, I'm usually in multiple SSH sessions at any given time during the day. I have 2 open right now.
Realistically I think I've done a good job for the most part with keeping HF online and secure. Not perfect but pretty good still.