Video Upload Options

References

1. Joris Claessens; Valentin Dem; Danny De Cock; Bart Preneel; Joos Vandewalle (2002). "On the Security of Today's Online Electronic Banking Systems". Computers & Security 21 (3): 253–265. doi:10.1016/S0167-4048(02)00312-7.  https://dx.doi.org/10.1016%2FS0167-4048%2802%2900312-7
2. null
3. Lawrence, Eric (2005-10-22). "IEBlog: Upcoming HTTPS Improvements in Internet Explorer 7 Beta 2". MSDN Blogs. Archived from the original on 2013-04-17. https://www.webcitation.org/6FwL2ooJz?url=http://blogs.msdn.com/b/ie/archive/2005/10/22/483795.aspx. Retrieved 2007-11-25. 
4. "Bugzilla@Mozilla — Bug 236933 – Disable SSL2 and other weak ciphers". Mozilla Corporation. https://bugzilla.mozilla.org/show_bug.cgi?id=236933. Retrieved 2007-11-25. 
5. "Opera 9.5 for Windows Changelog" at Opera.com: "Disabled SSL v2 and weak ciphers." http://www.opera.com/docs/changelogs/windows/950/
6. "Opera 10 for Windows changelog" at Opera.com: "Removed support for SSL v2 and weak ciphers" http://www.opera.com/docs/changelogs/windows/1000/
7. Pettersen, Yngve (2007-04-30). "10 years of SSL in Opera — Implementer's notes". Opera Software. Archived from the original on October 12, 2007. https://web.archive.org/web/20071012205124/http://my.opera.com/yngve/blog/2007/04/30/10-years-of-ssl-in-opera. Retrieved 2007-11-25. 
8. National Institute of Standards and Technology (December 2010). "Implementation Guidance for FIPS PUB 140-2 and the Cryptographic Module Validation Program". Archived from the original on November 6, 2010. https://web.archive.org/web/20101106130105/http://csrc.nist.gov/groups/STM/cmvp/documents/fips140-2/FIPS1402IG.pdf. 
9. "Summarizing Known Attacks on Transport Layer Security (TLS) and Datagram TLS (DTLS)". Archived from the original on 2016-03-04. https://web.archive.org/web/20160304201813/https://tools.ietf.org/html/rfc7457. 
10. "CVE – CVE-2009-3555". Archived from the original on 2016-01-04. https://web.archive.org/web/20160104234608/http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555. 
11. Eric Rescorla (2009-11-05). "Understanding the TLS Renegotiation Attack". Educated Guesswork. Archived from the original on 2012-02-09. https://www.webcitation.org/65JSTKRCA?url=http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html. Retrieved 2009-11-27. 
12. "SSL_CTX_set_options SECURE_RENEGOTIATION". OpenSSL Docs. 2010-02-25. Archived from the original on 2010-11-26. https://web.archive.org/web/20101126121933/http://openssl.org/docs/ssl/SSL_CTX_set_options.html#SECURE_RENEGOTIATION. Retrieved 2010-11-18. 
13. "GnuTLS 2.10.0 released". GnuTLS release notes. 2010-06-25. Archived from the original on 2012-02-09. https://www.webcitation.org/65JSUYEDA?url=http://article.gmane.org/gmane.network.gnutls.general/2046. Retrieved 2011-07-24. 
14. "NSS 3.12.6 release notes". NSS release notes. 2010-03-03. Archived from the original on March 6, 2012. https://web.archive.org/web/20120306184633/https://developer.mozilla.org/NSS_3.12.6_release_notes. Retrieved 2011-07-24. 
15. A. Langley; N. Modadugu (2010-06-02). "Transport Layer Security (TLS) False Start". Internet Engineering Task Force. IETF. Archived from the original on 2013-09-05. https://web.archive.org/web/20130905215608/http://tools.ietf.org/html/draft-bmoeller-tls-falsestart-00. Retrieved 2013-07-31. 
16. Gruener, Wolfgang. "False Start: Google Proposes Faster Web, Chrome Supports It Already". Archived from the original on 2010-10-07. https://web.archive.org/web/20101007061707/http://www.conceivablytech.com/3299/products/false-start-google-proposes-faster-web-chrome-supports-it-already/. Retrieved 2011-03-09. 
17. Smith, Brian. "Limited rollback attacks in False Start and Snap Start". Archived from the original on 2011-05-04. https://web.archive.org/web/20110504014418/http://www.ietf.org/mail-archive/web/tls/current/msg06933.html. Retrieved 2011-03-09. 
18. Dimcev, Adrian. "False Start". Random SSL/TLS 101. Archived from the original on 2011-05-04. https://web.archive.org/web/20110504060256/http://www.carbonwind.net/blog/post/Random-SSLTLS-101-False-Start.aspx. Retrieved 2011-03-09. 
19. Mavrogiannopoulos, Nikos; Vercautern, Frederik; Velichkov, Vesselin; Preneel, Bart (2012). A cross-protocol attack on the TLS protocol. Proceedings of the 2012 ACM conference on Computer and communications security. pp. 62–72. ISBN 978-1-4503-1651-4. https://www.cosic.esat.kuleuven.be/publications/article-2216.pdf. 
20. "SMACK: State Machine AttaCKs". Archived from the original on 2015-03-12. https://web.archive.org/web/20150312074827/https://www.smacktls.com/. 
21. Goodin, Dan (2015-05-20). "HTTPS-crippling attack threatens tens of thousands of Web and mail servers". Ars Technica. Archived from the original on 2017-05-19. https://web.archive.org/web/20170519130937/https://arstechnica.com/security/2015/05/https-crippling-attack-threatens-tens-of-thousands-of-web-and-mail-servers/. 
22. Leyden, John (1 March 2016). "One-third of all HTTPS websites open to DROWN attack". Archived from the original on 1 March 2016. https://web.archive.org/web/20160301215536/http://www.theregister.co.uk/2016/03/01/drown_tls_protocol_flaw/. 
23. "More than 11 million HTTPS websites imperiled by new decryption attack". Archived from the original on 2016-03-01. https://web.archive.org/web/20160301191108/http://arstechnica.com/security/2016/03/more-than-13-million-https-websites-imperiled-by-new-decryption-attack/. 
24. "Here Come The ⊕ Ninjas". 2011-05-13. Archived from the original on 2014-06-03. https://web.archive.org/web/20140603102506/https://bug665814.bugzilla.mozilla.org/attachment.cgi?id=540839. 
25. Dan Goodin (2011-09-19). "Hackers break SSL encryption used by millions of sites". Archived from the original on 2012-02-09. https://www.webcitation.org/65JSSbOus?url=http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/. 
26. "Y Combinator comments on the issue". 2011-09-20. Archived from the original on 2013-04-17. https://www.webcitation.org/6FwL5WZ8b?url=https://news.ycombinator.com/item?id=3015498. 
27. "Security of CBC Ciphersuites in SSL/TLS: Problems and Countermeasures". 2004-05-20. Archived from the original on 2012-06-30. https://web.archive.org/web/20120630143111/http://www.openssl.org/~bodo/tls-cbc.txt. 
28. Ristic, Ivan (Sep 10, 2013). "Is BEAST Still a Threat?". Archived from the original on 12 October 2014. https://web.archive.org/web/20141012121824/https://community.qualys.com/blogs/securitylabs/2013/09/10/is-beast-still-a-threat. Retrieved 8 October 2014. 
29. "Chrome Stable Release". Chrome Releases. 2011-10-25. Archived from the original on 2015-02-20. https://web.archive.org/web/20150220020306/http://googlechromereleases.blogspot.jp/2011/10/chrome-stable-release.html. Retrieved 2015-02-01. 
30. "Attack against TLS-protected communications". Mozilla Security Blog. Mozilla. 2011-09-27. Archived from the original on 2015-03-04. https://web.archive.org/web/20150304221307/https://blog.mozilla.org/security/2011/09/27/attack-against-tls-protected-communications/. Retrieved 2015-02-01. 
31. Brian Smith (2011-09-30). "(CVE-2011-3389) Rizzo/Duong chosen plaintext attack (BEAST) on SSL/TLS 1.0 (facilitated by websockets -76)". https://bugzilla.mozilla.org/show_bug.cgi?id=665814. 
32. "Vulnerability in SSL/TLS Could Allow Information Disclosure (2643584)". 2012-01-10. Archived from the original on 2014-08-15. https://web.archive.org/web/20140815234322/https://technet.microsoft.com/library/security/ms12-006. 
33. Ristic, Ivan (Oct 31, 2013). "Apple Enabled BEAST Mitigations in OS X 10.9 Mavericks". Archived from the original on 12 October 2014. https://web.archive.org/web/20141012122536/https://community.qualys.com/blogs/securitylabs/2013/10/31/apple-enabled-beast-mitigations-in-os-x-109-mavericks. Retrieved 8 October 2014. 
34. Dan Goodin (2012-09-13). "Crack in Internet's foundation of trust allows HTTPS session hijacking". Archived from the original on 2013-08-01. https://web.archive.org/web/20130801104610/http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/. Retrieved 2013-07-31. 
35. Dennis Fisher (September 13, 2012). "CRIME Attack Uses Compression Ratio of TLS Requests as Side Channel to Hijack Secure Sessions". ThreatPost. Archived from the original on September 15, 2012. https://web.archive.org/web/20120915224635/http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312. Retrieved 2012-09-13. 
36. Goodin, Dan (1 August 2013). "Gone in 30 seconds: New attack plucks secrets from HTTPS-protected pages". Ars Technica. Condé Nast. Archived from the original on 3 August 2013. https://web.archive.org/web/20130803181144/http://arstechnica.com/security/2013/08/gone-in-30-seconds-new-attack-plucks-secrets-from-https-protected-pages/. Retrieved 2 August 2013. 
37. Leyden, John (2 August 2013). "Step into the BREACH: New attack developed to read encrypted web data". The Register. Archived from the original on 5 August 2013. https://web.archive.org/web/20130805233414/http://www.theregister.co.uk/2013/08/02/breach_crypto_attack/. Retrieved 2 August 2013. 
38. Qualys SSL Labs. "SSL/TLS Deployment Best Practices". Archived from the original on 4 July 2015. https://web.archive.org/web/20150704101956/https://www.ssllabs.com/projects/best-practices/index.html. Retrieved 2 June 2015. 
39. P. Gutmann (September 2014). "Encrypt-then-MAC for Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)". Archived from the original on 2015-05-12. https://web.archive.org/web/20150512214100/https://tools.ietf.org/html/rfc7366. 
40. "This POODLE Bites: Exploiting The SSL 3.0 Fallback". Archived from the original on 2014-10-14. https://web.archive.org/web/20141014224443/https://www.openssl.org/~bodo/ssl-poodle.pdf. Retrieved 2014-10-15. 
41. Hagai Bar-El. "Poodle flaw and IoT". Archived from the original on 16 March 2015. https://web.archive.org/web/20150316030953/https://www.hbarel.com/analysis/eng/poodle-flaw-and-iot. Retrieved 15 October 2014. 
42. Langley, Adam (December 8, 2014). "The POODLE bites again". Archived from the original on December 8, 2014. https://web.archive.org/web/20141208200653/https://www.imperialviolet.org/2014/12/08/poodleagain.html. Retrieved 2014-12-08. 
43. security – Safest ciphers to use with the BEAST? (TLS 1.0 exploit) I've read that RC4 is immune – Server Fault http://serverfault.com/questions/315042/
44. ivanr. "RC4 in TLS is Broken: Now What?". Qualsys Security Labs. Archived from the original on 2013-08-27. https://web.archive.org/web/20130827044512/https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-what. Retrieved 2013-07-30. 
45. Pouyan Sepehrdad; Serge Vaudenay; Martin Vuagnoux (2011). Discovery and Exploitation of New Biases in RC4. 6544. 74–91. doi:10.1007/978-3-642-19574-7_5. ISBN 978-3-642-19573-0.  https://dx.doi.org/10.1007%2F978-3-642-19574-7_5
46. Green, Matthew. "Attack of the week: RC4 is kind of broken in TLS". Cryptography Engineering. Archived from the original on March 14, 2013. https://web.archive.org/web/20130314214026/http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html. Retrieved March 12, 2013. 
47. Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering and Jacob Schuldt. "On the Security of RC4 in TLS". Royal Holloway University of London. Archived from the original on March 15, 2013. https://web.archive.org/web/20130315084623/http://www.isg.rhul.ac.uk/tls/. Retrieved March 13, 2013. 
48. AlFardan, Nadhem J.; Bernstein, Daniel J.; Paterson, Kenneth G.; Poettering, Bertram; Schuldt, Jacob C. N. (8 July 2013). On the Security of RC4 in TLS and WPA. Archived from the original on 22 September 2013. https://web.archive.org/web/20130922170155/http://www.isg.rhul.ac.uk/tls/RC4biases.pdf. Retrieved 2 September 2013. 
49. AlFardan, Nadhem J.; Bernstein, Daniel J.; Paterson, Kenneth G.; Poettering, Bertram; Schuldt, Jacob C. N. (15 August 2013). "On the Security of RC4 in TLS" (PDF). 22nd USENIX Security Symposium. p. 51. Archived from the original on 22 September 2013. https://web.archive.org/web/20130922133950/https://www.usenix.org/sites/default/files/conference/protected-files/alfardan_sec13_slides.pdf. Retrieved 2 September 2013. "Plaintext recovery attacks against RC4 in TLS are feasible although not truly practical" 
50. Goodin, Dan. "Once-theoretical crypto attack against HTTPS now verges on practicality". Conde Nast. Archived from the original on 16 July 2015. https://web.archive.org/web/20150716084138/http://arstechnica.com/security/2015/07/once-theoretical-crypto-attack-against-https-now-verges-on-practicality/. Retrieved 16 July 2015. 
51. "Mozilla Security Server Side TLS Recommended Configurations". Mozilla. Archived from the original on 2015-01-03. https://web.archive.org/web/20150103093047/https://wiki.mozilla.org/Security/Server_Side_TLS. Retrieved 2015-01-03. 
52. "Security Advisory 2868725: Recommendation to disable RC4". Microsoft. 2013-11-12. Archived from the original on 2013-11-18. https://web.archive.org/web/20131118081816/http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2868725-recommendation-to-disable-rc4.aspx. Retrieved 2013-12-04. 
53. "Ending support for the RC4 cipher in Microsoft Edge and Internet Explorer 11". Microsoft Edge Team. September 1, 2015. Archived from the original on September 2, 2015. https://web.archive.org/web/20150902054341/http://blogs.windows.com/msedgedev/2015/09/01/ending-support-for-the-rc4-cipher-in-microsoft-edge-and-internet-explorer-11/. 
54. Langley, Adam (Sep 1, 2015). "Intent to deprecate: RC4". https://groups.google.com/a/chromium.org/forum/#!msg/security-dev/kVfCywocUO8/vgi_rQuhKgAJ. 
55. Barnes, Richard (Sep 1, 2015). "Intent to ship: RC4 disabled by default in Firefox 44". Archived from the original on 2011-01-22. http://arquivo.pt/wayback/20110122130054/https://groups.google.com/forum/#!topic/mozilla.dev.platform/JIEFcrGhqSM/discussion. 
56. John Leyden (1 August 2013). "Gmail, Outlook.com and e-voting 'pwned' on stage in crypto-dodge hack". The Register. Archived from the original on 1 August 2013. https://web.archive.org/web/20130801193054/http://www.theregister.co.uk/2013/08/01/gmail_hotmail_hijacking/. Retrieved 1 August 2013. 
57. "BlackHat USA Briefings". Black Hat 2013. Archived from the original on 30 July 2013. https://web.archive.org/web/20130730124037/http://www.blackhat.com/us-13/briefings.html#Smyth. Retrieved 1 August 2013. 
58. Smyth, Ben; Pironti, Alfredo (2013). "Truncating TLS Connections to Violate Beliefs in Web Applications". 7th USENIX Workshop on Offensive Technologies. Archived from the original on 6 November 2015. https://web.archive.org/web/20151106110117/https://hal.inria.fr/hal-01102013. Retrieved 15 February 2016. 
59. Goodin, Dan. "New attack bypasses HTTPS protection on Macs, Windows, and Linux". Condé Nast. Archived from the original on 27 July 2016. https://web.archive.org/web/20160727160434/http://arstechnica.com/security/2016/07/new-attack-that-cripples-https-crypto-works-on-macs-windows-and-linux/. Retrieved 28 July 2016. 
60. Goodin, Dan (August 24, 2016). "HTTPS and OpenVPN face new attack that can decrypt secret cookies". Ars Technica. Archived from the original on August 24, 2016. https://web.archive.org/web/20160824181630/http://arstechnica.com/security/2016/08/new-attack-can-pluck-secrets-from-1-of-https-traffic-affects-top-sites/. 
61. "Why is it called the 'Heartbleed Bug'?". The Washington Post. 2014-04-09. Archived from the original on 2014-10-09. https://web.archive.org/web/20141009063758/http://www.washingtonpost.com/blogs/style-blog/wp/2014/04/09/why-is-it-called-the-heartbleed-bug/. 
62. "Heartbleed Bug vulnerability [9 April 2014"]. Comodo Group. Archived from the original on 5 July 2014. https://web.archive.org/web/20140705212748/https://blogs.comodo.com/e-commerce/heartbleed-bug-comodo-urges-openssl-users-to-apply-patch/. 
63. Bleichenbacher, Daniel (August 2006). "Bleichenbacher's RSA signature forgery based on implementation error". Archived from the original on 2014-12-16. https://web.archive.org/web/20141216203704/http://www.imc.org/ietf-openpgp/mail-archive/msg06063.html. 
64. "BERserk". Intel Security: Advanced Threat Research. September 2014. Archived from the original on 2015-01-12. https://web.archive.org/web/20150112153121/http://www.intelsecurity.com/advanced-threat-research/. 
65. Goodin, Dan (February 19, 2015). "Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections". Archived from the original on September 12, 2017. https://web.archive.org/web/20170912103610/https://arstechnica.com/information-technology/2015/02/lenovo-pcs-ship-with-man-in-the-middle-adware-that-breaks-https-connections/. Retrieved December 10, 2017. 
66. Valsorda, Filippo (2015-02-20). "Komodia/Superfish SSL validation is broken". Filippo.io. Archived from the original on 2015-02-24. https://web.archive.org/web/20150224112141/https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/. 
67. Goodin, Dan. ""Forbidden attack" makes dozens of HTTPS Visa sites vulnerable to tampering". Archived from the original on 26 May 2016. https://web.archive.org/web/20160526175713/http://arstechnica.com/security/2016/05/faulty-https-settings-leave-dozens-of-visa-sites-vulnerable-to-forgery-attacks/. Retrieved 26 May 2016. 
68. Clark Estes, Adam. "Everything You Need to Know About Cloudbleed, the Latest Internet Security Disaster". Archived from the original on 2017-02-25. https://web.archive.org/web/20170225013516/http://gizmodo.com/everything-you-need-to-know-about-cloudbleed-the-lates-1792710616. Retrieved 2017-02-24. 
69. As of May 3, 2019. "SSL Pulse: Survey of the SSL Implementation of the Most Popular Websites". https://www.ssllabs.com/ssl-pulse/. Retrieved 2019-05-09. 
70. Diffie, Whitfield; van Oorschot, Paul C; Wiener, Michael J. (June 1992). "Authentication and Authenticated Key Exchanges". Designs, Codes and Cryptography 2 (2): 107–125. doi:10.1007/BF00124891. Archived from the original on 2008-03-13. https://web.archive.org/web/20080313081157/http://citeseer.ist.psu.edu/diffie92authentication.html. Retrieved 2008-02-11. 
71. Discussion on the TLS mailing list in October 2007 http://www1.ietf.org/mail-archive/web/tls/current/msg02134.html
72. "Protecting data for the long term with forward secrecy". Archived from the original on 2013-05-06. https://web.archive.org/web/20130506184654/http://googleonlinesecurity.blogspot.com.au/2011/11/protecting-data-for-long-term-with.html. Retrieved 2012-11-05. 
73. Bernat, Vincent. "SSL/TLS & Perfect Forward Secrecy". Archived from the original on 2012-08-27. https://web.archive.org/web/20120827064047/http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-secrecy.html. Retrieved 2012-11-05. 
74. "SSL Labs: Deploying Forward Secrecy". Qualys.com. 2013-06-25. Archived from the original on 2013-06-26. https://web.archive.org/web/20130626193314/https://community.qualys.com/blogs/securitylabs/2013/06/25/ssl-labs-deploying-forward-secrecy. Retrieved 2013-07-10. 
75. Ristic, Ivan (2013-08-05). "SSL Labs: Deploying Forward Secrecy". Qualsys. Archived from the original on 2013-09-20. https://web.archive.org/web/20130920150259/https://community.qualys.com/blogs/securitylabs/2013/06/25/ssl-labs-deploying-forward-secrecy. Retrieved 2013-08-31. 
76. Langley, Adam (27 June 2013). "How to botch TLS forward secrecy". Archived from the original on 8 August 2013. https://web.archive.org/web/20130808221614/https://www.imperialviolet.org/2013/06/27/botchingpfs.html. 
77. Daignière, Florent. "TLS "Secrets": Whitepaper presenting the security implications of the deployment of session tickets (RFC 5077) as implemented in OpenSSL". Matta Consulting Limited. Archived from the original on 6 August 2013. https://web.archive.org/web/20130806233112/https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-WP.pdf. Retrieved 7 August 2013. 
78. Daignière, Florent. "TLS "Secrets": What everyone forgot to tell you...". Matta Consulting Limited. Archived from the original on 5 August 2013. https://web.archive.org/web/20130805134805/https://media.blackhat.com/us-13/US-13-Daigniere-TLS-Secrets-Slides.pdf. Retrieved 7 August 2013. 
79. L.S. Huang; S. Adhikarla; D. Boneh; C. Jackson (2014). "An Experimental Study of TLS Forward Secrecy Deployments". IEEE Internet Computing 18 (6): 43–51. doi:10.1109/MIC.2014.86. Archived from the original on 20 September 2015. https://web.archive.org/web/20150920011317/http://crypto.stanford.edu/~dabo/pubs/abstracts/websec_ecc.html. Retrieved 16 October 2015. 
80. "Protecting data for the long term with forward secrecy". Archived from the original on 2014-02-12. https://web.archive.org/web/20140212214518/http://googleonlinesecurity.blogspot.com.au/2011/11/protecting-data-for-long-term-with.html. Retrieved 2014-03-07. 
81. Hoffman-Andrews, Jacob. "Forward Secrecy at Twitter". Twitter. Archived from the original on 2014-02-16. https://web.archive.org/web/20140216041202/https://blog.twitter.com/2013/forward-secrecy-at-twitter-0. Retrieved 2014-03-07. 
82. Durumeric, Zakir; Ma, Zane; Springall, Drew; Barnes, Richard; Sullivan, Nick; Bursztein, Elie; Bailey, Michael; Halderman, J. Alex et al. (5 September 2017). "The Security Impact of HTTPS Interception". NDSS Symposium. doi:10.14722/ndss.2017.23456. https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/security-impact-https-interception/.