With the continuous drive towards establishing HTTPS Everywhere it is high time to check on the real security and also the misconfigurations, the security header implementation and other security aspects.
Important insights came from HTTPS Everywhere Atlas and websites with issues there, various header and SSL-check scans and also through an extension Tracker SSL, Check SSL, Safer Chrome Security Report, Webpage Behavior Report combined with Privacy Badger. From Tracker SSL and EFF info it appeared to me that SSL can be secure, but that anonimyzed tracking IDS are exempted and some tracker IDS do not support secure transmission. This could lead to NSA snooping as the anonimyzed tracking IDS from Google for instance could be de-anonymized and personalized by re-targeting with personal info found elsewhere, helped with fingerprinting and geo-location profiling you into detail does not really require rocket-technology. Here your privacy is non-existant by design. So keep that info always at the back of your mind, what goes onto the Interwebs is like sending out a global message for everyone to see.
Now there are still a lot of sites that have SSL but the log-on info is insecure and all there "goes over the wire" unencrypted as plain txt. With proxies etc. you are depending on the integrity of that service. What happens to your info in the cloud for instance. Do they wanna market it to the highest bidder or with whom they wanna share.
Are widget and buttons rendered harmless by Privacy Badger for instance? Interesting information I also got from doing a tracker tracker report on scripts and particularly on so-called SPOF scripts that slow down the loading of pages considerable, notorious in this respect is Google monitoring.
Let us take an example now from the HTTPS Everywhere Atlas. Here at
http://www.oag.com/Store we have a
Website is insecure by default
42% of the trackers on this site could be protecting you from NSA snooping. Tell oag.com to fix it.
Identifiers | All Trackers
Insecure Identifiers
Unique IDs about your web browsing habits have been insecurely sent to third parties.
d811450cde054c7ebc3d12f1cb3cda08e1444324431 local.adguard.com __cfduid (As I have Adguard Beta installed).
Legend
Tracking IDs could be sent safely if this site was secure.
Tracking IDs do not support secure transmission.
Now over to
https://www.oag.com/Store. As with the other site we see outdated software here:
HTTP Server: IIS 7.5
Operating System: Windows Server 2008 R2
PHP Version: 5.3.9 (Outdated) Asafaweb scan delivers 4 warnings:
https://asafaweb.com/Scan?Url=https%3A%2F%2Fwww.oag.com%2FStore fitting in with the 67% of asp sites with problems
Then we have Possible Frontend SPOF from:
-html5shiv.googlecode.com - Whitelist
(49%) - <script src="-http://html5shiv.googlecode.com/svn/trunk/html5.js">
ajax.googleapis.com - Whitelist
(49%) - <script type="text/javascript" src="//ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js">
The page also tries to load scripts from non-verified sources.
But
100% of the trackers on this site are helping protect you from NSA snooping. Why not thank oag.com for being secure?
Identifiers | All Trackers
Secure Identifiers
Unique IDs about your web browsing habits have been securely sent to third parties.
Which trackers were:
At least 5 third parties know you are on this webpage.
www.oag.com www.oag.com
local.adguard.com *
js.hs-analytics.net
Amazon.com
shaaaaaaaaaaaaa.com *
* extension related.
The re-writing efforts:
https://www.eff.org/https-everywhere/atlas/domains/oagtravel.com.htmlSee also:
http://toolbar.netcraft.com/site_report?url=https://www.oag.comWebsite Risk Status 1 red out of 10 and no PFS
Poodle Scan -> Bingo:
TLS_FALLBACK_SCSV Not Supported
Exclamation-point
Your server does not support the new TLS_FALLBACK_SCSV flag. This flag prevents newer clients from being forcibly downgraded to an insecure SSL version. Remember, your clients and server must both implement the (very new) TLS_FALLBACK_SCSV cipher flag. See here for a ton of information on patching your clients and servers.
Vulnerable Ciphers Still Supported:
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
Just a check on a random HTTPS site shows there is still lots and lots to be done and left to make the Interwebs a tiny fraction more reliable. I guess not everyone will be into third party cold reconnaissance scanning like some others and little old me here are performing, but going through the results everyone should learn caution. The Interwebs could be a dangerous world to visit.
My question what security and privacy did I ad by installing Adguard. I keep testing it and expect some further reporting.
Oh and as a desert the tracker tracker report from
https://www.oag.com/Store scripts, see attached!
Also consider:
http://www6.userexp.net/oagaviation.com.htmlpolonus (volunteer website security analyst and website error-hunter)
