Browser developers gang up on hackers

By

Developers from four rival firms met to work on combating security threats with proposals for safer next generation browsers.

The meeting was arranged to discuss plans to combat the security risks posed by phishing, ageing encryption ciphers and inconsistent SSL certificate practice. Security developers from Microsoft, Mozilla/Firefox, Opera and Konqueror agreed on a number of points including plans to introduce stronger encryption protocols.


Linux-based K Desktop Environment (KDE) developer George Staikos, who hosted the meeting, said the availability of botnets and massively distributed computing meant current encryption standards "are showing their age."

"Prompted by Opera, we are moving towards the removal of SSLv2 from our [Konqueror] browsers," said Staikos. "IE will disable SSLv2 in version 7 and it has been completely removed in the KDE 4 source tree already.

He said that KDE will in future look to remove 40- and 56-bit ciphers, and work toward "preferring and enforcing stronger ciphers as testing shows that site compatibility is not adversely affected.

"In addition, we will encourage certificate authorities (CAs) to move toward 2048-bit or stronger keys for all new roots."

Staikos said stronger cryptography rules help to protect users from malicious cracking attempts. He said browser developers will aim to promote, encourage, and eventually enforce much stricter procedures for certificate signing authorities.

He said the present system meant that all CAs are considered equal, irrespective of their credentials and practices. He said that with a definition of a new "strongly verified" certificate, "we can give users a more prominent indicator of authentic high-profile sites, in contrast to the phishing sites that are becoming so prevalent today."

http://dot.kde.org/1132619164/

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?