Browser developers gang up on hackers

Powered by SC Magazine
 

Developers from four rival firms met to work on combating security threats with proposals for safer next generation browsers.

The meeting was arranged to discuss plans to combat the security risks posed by phishing, ageing encryption ciphers and inconsistent SSL certificate practice. Security developers from Microsoft, Mozilla/Firefox, Opera and Konqueror agreed on a number of points including plans to introduce stronger encryption protocols.

Linux-based K Desktop Environment (KDE) developer George Staikos, who hosted the meeting, said the availability of botnets and massively distributed computing meant current encryption standards "are showing their age."

"Prompted by Opera, we are moving towards the removal of SSLv2 from our [Konqueror] browsers," said Staikos. "IE will disable SSLv2 in version 7 and it has been completely removed in the KDE 4 source tree already.

He said that KDE will in future look to remove 40- and 56-bit ciphers, and work toward "preferring and enforcing stronger ciphers as testing shows that site compatibility is not adversely affected.

"In addition, we will encourage certificate authorities (CAs) to move toward 2048-bit or stronger keys for all new roots."

Staikos said stronger cryptography rules help to protect users from malicious cracking attempts. He said browser developers will aim to promote, encourage, and eventually enforce much stricter procedures for certificate signing authorities.

He said the present system meant that all CAs are considered equal, irrespective of their credentials and practices. He said that with a definition of a new "strongly verified" certificate, "we can give users a more prominent indicator of authentic high-profile sites, in contrast to the phishing sites that are becoming so prevalent today."

http://dot.kde.org/1132619164/

Copyright © SC Magazine, US edition


 
 
 
Top Stories
The ethics of security
[Blog post] Where did that zero-day go?
 
Rio Tinto's big data play delivers promised ore
Returns trickle in from long-term technology investment.
 
Time management tips for CIOs
[Blog post] How to get to the genba.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  70%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  10%
 
Denial of service attacks
  6%
 
Insider threats
  11%
TOTAL VOTES: 1149

Vote