ScienceDaily: Latest Science News: Security protocol for online banking and Facebook has ‘serious weaknesses,’ say researchers

ScienceDaily: Latest Science News

Breaking science news and articles on global warming, extrasolar planets, stem cells, bird flu, autism, nanotechnology, dinosaurs, evolution -- the latest discoveries in astronomy, anthropology, biology, chemistry, climate and environment, computers, engineering, health and medicine, math, physics, psychology, technology, and more -- from the world's leading universities and research organizations.

Security protocol for online banking and Facebook has 'serious weaknesses,' say researchers
http://feeds.sciencedaily.com/~r/sciencedaily/~3/65QZiUMa2go/130203212413.htm
Feb 4th 2013, 02:24

Feb. 1, 2013 — The protocol that provides security for online banking, credit card data and Facebook has major weaknesses, according to researchers at Royal Holloway University.

The Transport Layer Security (TLS) protocol is used by millions of people on a daily basis. It provides security for online banking, as well as for credit card data when shopping on the Internet. In addition, many email systems in the workplace use it, as well as a number of big companies including Facebook and Google.
Professor Kenny Paterson from the Information Security Group at Royal Holloway and PhD student Nadhem AlFardan found that a so-called 'Man-in-the Middle' attack can be launched against TLS and that sensitive personal data can be intercepted in this way. They have identified a flaw in the way in which the protocol terminates TLS sessions. This leaks a small amount of information to the attacker, who can use it to gradually build up a complete picture of the data being sent.
Professor Paterson said: "While these attacks do not pose a significant threat to ordinary users in its current form, attacks only get better with time. Given TLS's extremely widespread use, it is crucial to tackle this issue now.
"Luckily we have discovered a number of countermeasures that can be used. We have been working with a number of companies and organisations, including Google, Oracle and OpenSSL, to test their systems against attack and put the appropriate defences in place."
Share this story on Facebook, Twitter, and Google:

Other social bookmarking and sharing tools:

Story Source:

The above story is reprinted from materials provided by University of Royal Holloway London, via AlphaGalileo.
Note: Materials may be edited for content and length. For further information, please contact the source cited above.





Note: If no author is given, the source is cited instead.

Disclaimer: Views expressed in this article do not necessarily reflect those of ScienceDaily or its staff.
This entry passed through the Full-Text RSS service — if this is your content and you're reading it on someone else's site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers. Five Filters recommends: Eyes Like Blank Discs - The Guardian's Steven Poole On George Orwell's Politics And The English Language.



You are receiving this email because you subscribed to this feed at http://blogtrottr.com

If you no longer wish to receive these emails, you can unsubscribe here:
http://blogtrottr.com/unsubscribe/cz0/tSbHWJ