UK Gov sites hijacked by Cryptominer, and Subresource Integrity

Over the weekend, thousands of websites around the world, including the UK’s NHS and ICO and the US Government Court system, were compromised, and caused visitors to mine crypto-coins – generating money for the miscreants. These sites were using a popular plugin called Browsealoud. Their support software “adds speech, reading, and translation to websites facilitating … Read more

Secure Websites – HTTPS, SSL, and Let’s Encrypt

Many websites are switching to HTTPS, a secure website. Including us! You can see in your URL bar, that our website address now has a small padlock. This indicates that all the communications between you and our server is encrypted and much harder, or impossible, to view what is being sent and received. How TLS/SSL/HTTPS … Read more

DigiNotar CA hack, and serious weaknesses in security

Support for TLS 1.1 and 1.2 is virtually non-existent, Qualys Director of Engineering Ivan Ristic says via The Register

DigiNotar, the Dutch certificate authority was recently the center of a significant hacking case. On the 19th July, the CA discovered that at least 531 rogue certificates has been issued. However, it was only in August that the attacked became public knowledge. Security firm, Fox-IT were hired to investigate the breach, and the compromise has … Read more