In the upcoming NLUUG autumn conference on security and privacy, there will be a presentation of Teus Hagen on SSL security.
For people not very familiar with SSL a short introduction: SSL protects (or should protect, more on that in part 2) communication on the internet against eavesdropping. Basically all communications on the internet can be eavesdropped. This problem becomes a lot more urgent when using open wireless access-points or badly secured access-points. Also people with access to network equipment in the same building can easily eavesdrop the traffic. Think about your boss, your system-administrator or anybody with a bit technical skills in your home. The (correct) usage of SSL effectively eliminates the possibility to eavesdrop.
For psychosocial support sites confidentiality is very important. You don't want your boss to know about your alcohol problem. And believe me, you don't want your daddy to read over your shoulder when you chat with a counselor about him abusing you. So SSL is what you want for psychosocial support sites.
Teus Hagen wanted to see if SSL is deployed correctly in practice. If not so, the security of SSL can vastly decrease. For his paper he researches several kind of sites, including sites for psychosocial support. And because I work a lot with security in psychosocial support, I went of to compose a list of sites in the Netherlands he should test. Well: the results where shocking: More then a quarter of the sites that I thought Teus should test, didn't use SSL. No security for him to test, because there is no security at all on those sites!
I will mention some noticeable sites without SSL:
- http://shginfo.nl/ This is the site of the most important organization against domestic violence in the Netherlands. In many ways they set the best-practice. They thought quite well on how they can avoid that it becomes obvious to others when somebody visited the site. But they don't use SSL.
- http://www.113online.nl/ A major initiative for suicide prevention, including online counseling. SSL is available, but by default it is off.
- http://www.korrelatie.nl/ general first line aid, also online, one of the major players in the Netherlands. No SSL.
- http://www.kindertelefoon.nl/ the Dutch child helpline. They also offer chat and forum. No SSL.
- http://www.minderdrinken.nl/ online treatment for alcohol addiction. No SSL.
- http://optijderbij.nl/ Psychological/Psychiatric institution. They do a big part of the intake online, including a lot of diagnostics. All without SSL.
What struck me, when looking at the sites, was the pattern in it, or to be precise: the lack of it. Many sites were only partially protected with SSL. There were for example several sites that offered a SSL protected chat, but that had an e-mail form or a forum that wasn't protected at all. I also encountered several large organizations that operated multiple support sites. They had some of their sites protected with SSL and others not. Overall, it seems to be quite arbitrary what is protected and what not. Looks like a lack of policy. And a lack of regulation...