Secure Browser Settings

I know this is going to be long and technical, but it is important for everyone regardless of your technical ability to look at.
The one line TLDR version (TLDR is internet speak for "too long, didn't read") is this:
Secure sites use SSL. TLS is the newer SSL. You should be using the newest one you can.

Ok, so for a while now webmasters, IT people, developers etc, have been slowly transitioning the internet away from SSL 2.0 to newer versions of the protocol. SSL is the s in https:// it is the secure part of secure websites. Version 1 was phased out before most folks even knew there was an internet, but version 2.0 has stuck with us, despite being broken in many different ways, for a long time.  The payment card industry, via their PCI-DSS rules by which individual merchants have to run their payment networks, and banking systems have to communicate with merchants across data networks like the internet, has outlawed the use of SSL 2.0. A while back. And so, most websites and some browsers (I think all browsers except Internet Explorer) have abandoned the old clunker of a security protocol. By default most newer web browsers support SSL 3.0 and TLS 1.0 (which can be thought of as SSL 3.1 or 4.0).

TLS 1.0 was first introduced back in 1999. In 2002 a theoretical exploit was discovered. About a year ago that exploit, dubbed the BEAST (Browser Exploit Against SSL and TLS) was made easy to do. It allows a person who can insert themselves between the user's browser and the secured web server to pick and choose what bits of encrypted data get sent and use the chosen length bits of ciphered text to get a head start on decrypting the conversation. This is effective only against SSL 3.0 and TLS 1.0, and only when they use block ciphers like AES and 3DES not stream ciphers like RC4. Because they have decided that we've had enough time, the payment card industry is starting to insist that merchants protect against the BEAST attack. This can cause someone with inadequate security settings on their browser to get a blank page when trying to connect to a secure website.

So far TLS 1.1 and 1.2 are still quite secure, but not used everywhere yet and not supported by every browser.

I'm going to show you how to turn on the best protocol available to you in the most popular browsers and then if you are also a techie running a server, I'll go into how to do the server side.

First Internet Explorer:


For Internet Explorer:  In internet options, under the advanced tab, scroll almost all the way to the bottom and you will find these settings.
By default SSL 2.0, SSL 3.0 and TLS 1.0 should be on, I am recommending that all users switch off SSL 2.0 as no sites on the internet rely on that anymore, and it is a very broken protocol.
Also,  if available (if you have Windows 7 or higher) you should turn on TLS 1.1 and TLS 1.2 as well.


Now Firefox:



Firefox  already should have only SSL 3.0 and TLS 1.0 enabled. If it does not have TLS 1.0 checked please make sure you enable it.
Again, TLS 1.0 dates back to 1999 there has been over a decade of use ensuring that all sites and browsers are compatible.
The only reason to have it turned off is if you are US Government and required to use only 1.1 and 1.2  :)  but as we can see with the Firefox example, not having anything older than 1.1 means breaking compatibility.

On the server side...

IIS:

IIS uses the Microsoft SChannel settings. The protocol versions it supports are turned on in the registry. Paste the following code into a file called saferSSL.reg or something like that. then double click on your new .reg file to import those settings.
Windows Registry Editor Version 5.00 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56] 
"Enabled"=dword:00000000 
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server] 
"Enabled"=dword:00000000


And optionally (this one will break compatibility with IE6):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server] 
"Enabled"=dword:00000000


And then to enable TLS 1.1 and 1.2:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1] 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\client] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2] 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\client] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 
 
Then go into the group policy editor (type gpedit.msc into the run box or command line)
Find the section: Local Computer Policy -> Administrative Templates -> Network -> SSL Configuration Settings
edit the Cipher Order value to include only RC4 ciphers for SSL 3.0 and TLS 1.0.
Move "TLS_RSA_WITH_RC4_128_SHA" to the top of the priority list, and get rid of any SSL 3.0 or TLS 1.0 ciphersuites with CBC in the name. You can keep whatever TLS 1.1 or 1.2 ciphers you need (hint anything with SHA256 or higher is fine). If you are not sure what to include just copy this string into that box and click OK.

IIS 7.5:

TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_RC4_128_MD5,SSL_CK_RC4_128_WITH_MD5,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521

IIS 7.0:

TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_RC4_128_MD5,SSL_CK_RC4_128_WITH_MD5


Apache:
Put this into your config

SSLHonorCipherOrder On
SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH

Watch What Permissions You Give

Watch what permissions you grant to apps on social sites and on your cell phone.

I logged into Facebook today and there was a message " wants to include you as a travel connection in Tripadvisor."

I clicked it and saw this (faces obscured for privacy reasons):

I don't know why Tripadvisor needs to have access to all that in order to make travel suggestions, but I'd never grant it. On the other hand, my work issued blackberry has been prompting me lately saying that the Phone app would like to access phone information. ...well, Duh! of course the phone part of my cellphone needs access to phone information. Funny thing though, I denied it and was still able to use the phone... so I'm not sure what phone info it needs, but It seemed to be doing ok without it.

Test Your Passwords

This is a little follow-up to the post about learning to program in python.
I thought I would throw some code out there for people to play with.

This program is written in python3. It prompts the user to enter a password that they want to test and compares it to complexity requirements and then checks if it is in a file called passwords.txt in the working directory.  It will tell the user if the password meets complexity requirements (currently set for windows' standard for complexity (8+ characters and 3 of the 4 categories: upper case, lower case, number or special characters)  There are some unused functions in this such as num_specials() that are there in case you want to customize it for stricter password requirements.

You will need to provide a passwords.txt file with one word per line of passwords that the user should not use. A good place to look for password lists is pastebin.com

If you are learning python then take a look at the code, run it in IDLE, play with the functions, see if you can extend it to do something cool.

If you are not learning python that's cool just place a password.txt file in the same directory full of words you don't think are good to use (The top 10 most used passwords is a start), and run it like so:

python3 passwordStrengthChecker.py

 Anyway, here is that code:

Want To Learn To Program A Computer?

If you have never taken a computer programming course before I'd strongly recommend picking up python as your first programming language. (version 3 if you are starting from scratch)

Take a beginner's course over at Coursera.  I highly recommend the University of Toronto one, Learn to Program: The Fundamentals, which is just wrapping up it's first semester now (and should be starting again soon) Paul and Jen's approach of teaching functions first, starting with defining exactly what the function should do, including examples of inputs and the expected outputs, in the docstring, then moving on to actually coding the function to do that is much easier to get your head around than the way I learned programming back in the early to mid 1990's.

Of course there is also Google's Python Class that is available on-demand, but not as interactive.There is thenewboston's YouTube tutorials, which are really engaging and perfect for new programmers.
Or there's Codecademy: Python or if those methods don't work for you, there's Learn Python the hard way pick what works for you. They are all free.

Pick up a free e-book, or perhaps several of them, from http://pythonbooks.revolunet.com/

I'd recommend starting with Think Python: How to Think Like a Computer Scientist or Dive Into Python 3.

The main thing that holds a lot of us back from learning how to code is not having an idea of what we would like to do with the code. Sometimes all it takes is just sitting back and thinking about problems that you'd like to solve, tasks you do repeatedly every day, every week or every month that could be simplified because you do the same thing every time, again and again. Those are things that computer programs are good for.

I manage a lot of windows computers. Some of them are on the old side, running dangerously close at times to the limits of what their hard disks can hold. Time and again, I found myself going in and deleting uninstall files for updates I knew I would never be uninstalling, just to free up a little space. So, I wrote a program that looks for those files and checks how old they are. If an update was installed more than 90 days ago it deletes the uninstall folder for it. Launching that program saves a bit of precious time each time I find I'm in that position of having to free up some disk space ASAP.

Sit down and think, what tasks like that could you automate? I bet there are at least a few.

Another one was a program that reads a comma separated list of computers (name, ip address, mac address) and uses Wake On LAN to wake the computers in that list up at a specific time. At first I had it call a command line based wake on lan program I downloaded from the net, but later I revised it to create and send the WOL Magic Packets itself ...The possibilities are basically endless.

Free E-book - Learn Windows 8

 Are you looking for a good book to learn Microsoft's new Windows 8 operating system? Start with this free one from Microsoft :

Introducing Windows 8: An Overview for IT Professionals

more free e-books