Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I disabled SSL2 and SSL3 in my Firefox browser, version 24. I only enabled TLS 1.1 and 1.2. Unfortunately when I went to my bank's website, I found that it didn't work until I re-enabled TLS 1.0.

Additional information: my bank site uses RSA encryption.

Does that mean my bank's website is less secure than is should be, or is this acceptable?

share|improve this question
    
No SSL/TLS ciphersuite that's currently in use will survive large quantum computers. –  CodesInChaos Oct 21 '13 at 8:00
    
@OP: you may also wish to clarify "bank security". Do you mean the strength of the encryption of the connection between the bank and you, the security of the bank website with respect to attacks on the site itself, or something else? –  Nasrus Oct 22 '13 at 16:34
add comment

migrated from crypto.stackexchange.com Oct 22 '13 at 16:24

This question came from our site for software developers, mathematicians and others interested in cryptography.

1 Answer

What this means is that your bank's server supports TLS-1.0, not 1.1 or 1.2. Versions 1.1 and 1.2 adds some extra features, but that does not mean that TLS-1.0 is weak. In fact the only relevant security feature added by TLS-1.1 over 1.0 is the per-record random IV. This feature inherently protects against some chosen-plaintext attacks, namely the so-called "BEAST attack". However, this attack can also be defeated with SSL-3.0 and TLS-1.0 if the client implements a workaround known as the 1/n-1 split, and Firefox implements it. Also, BEAST can be leveraged only by exploiting a Same-Origin-Policy hole, and no such hole is currently known in current browsers (the two which were used in BEAST demonstrations have been fixed since that time).

For these two reasons, you should not worry about TLS-1.0. In very general terms, it is best when people deploy new protocol versions, so that the new features percolate worldwide; but there is no urgency.

When your bank account gets plundered, it won't be through a TLS protocol hole. Malware installed on your machine is a much bigger threat, indeed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.