SSL

Data Compression in Chrome Beta for Android

Submitted by admin on Tue, 03/05/2013 - 17:02

Today’s Chrome Beta for Android update brings your saved passwords and autofill entries from your desktop to your phone and tablet. This release also introduces an experimental data compression feature that will yield substantial bandwidth savings. This feature is powered by a connection to a SPDY proxy running on Google’s servers, paired with content optimization performed by our open-source PageSpeed libraries, specifically tuned for Chrome Beta on Android.

HTTPS Everywhere 3.0 Keeps Your Data Safe on 1,500 More Web Sites

Submitted by admin on Tue, 10/09/2012 - 15:30

Chrome/Firefox: HTTPS Everywhere, the browser extension that keeps your data from falling into the wrong hands, has updated to double the number of web sites it supports. If you aren't using it, you should be. More »

HTTPS Everywhere Keeps Your Personal Information Safe on Over 1,400 Sites, Available for Firefox and Chrome

Submitted by admin on Tue, 02/28/2012 - 16:30

Chrome/Firefox: HTTPS Everywhere is a simple extension that, with just a one-click installation, can seriously increase your security on over 1,400 web sites by encrypting your connection. More »

 

Google Chrome SSL Enforcer

Submitted by admin on Sun, 01/08/2012 - 08:56

Making sure that you are connected via SSL is one of the most important things Internet users can do to improve their security online. This is especially true on public computer networks, like those on airports, Internet cafes or on campus. Why? Because it is otherwise dead easy to wiretap the traffic that you send and receive on the network. And while that may not be an issue for some activities online, you better be sure when you sign into accounts or handle financial transactions on sites such as PayPal or your bank’s online presence.

KB SSL Enforcer is a Google Chrome extension that allows you to enforce SSL encryption on websites and services that support it. If it detects that a site is offering both http and https connections, it will automatically connect the user to the more secure https connection to improve online security.

The extension handles the detection and switching to SSL automatically. The concept is very similar to HTTPS Everywhere for the Firefox web browser, with the difference that HTTPS Everywhere only enforces SSL on sites in its database (with options to create your own rule sets).

The extension maintains a list of sites supporting SSL that you have accessed in the cache to speed up future connections.

You may however come upon sites sometimes that do not work properly when connecting to them via https. A blacklist is provided that will block the automatic redirection to https for listed sites. Open the settings of SSL Enforcer by loading the following url in the web browser (chrome://settings/extensions) and clicking on the Options link next to the extension.

ssl enforcer

The extension handles domains with and without www differently. You can change that in the options so that rules defined for a site apply to both versions.

You can also add sites to a whitelist, which you may need to do if the automatic detection does not discover if a domain supports SSL connections.

Google Chrome users can download SSL Enforcer from the official Chrome web store.

SSL FalseStart Performance Results

Submitted by admin on Thu, 05/19/2011 - 01:34
Last year, Google’s Adam Langley, Nagendra Modadugu, and Bodo Moeller proposed SSL False Start, a client-side only change to reduce one round-trip from the SSL handshake.
 
We implemented SSL False Start in Chrome 9, and the results are stunning, yielding a significant decrease in overall SSL connection setup times. SSL False Start reduces the latency of a SSL handshake by 30%1. That is a big number. And reducing the cost of a SSL handshake is critical as more and more content providers move to SSL.
 
Our biggest concern with implementing SSL False Start was backward compatibility. Although nothing in the SSL specification (also known as TLS) explicitly prohibits FalseStart, there was no easy way to know whether it would work with all sites. Speed is great, but if it breaks user experience for even a small fraction of users, the optimization is non-deployable.
 
To answer this question, we compiled a list of all known https websites from the Google index, and tested SSL FalseStart with all of them. The result of that test was encouraging: 94.6% succeeded, 5% timed out, and 0.4% failed. The sites that timed out were verified to be sites that are no longer running, so we could ignore them.
 
To investigate the failing sites, we implemented a more robust check to understand how the failures occurred. We disregarded those sites that failed due to certificate failures or problems unrelated to FalseStart. Finally, we discovered that the sites which didn’t support FalseStart were using only a handful of SSL vendors. We reported the problem to the vendors, and most have fixed it already, while the others have fixes in progress. The result is that today, we have a manageable, small list of domains where SSL FalseStart doesn’t work, and we’ve added them to a list within Chrome where we simply won’t use FalseStart. This list is public and posted in the chromium source code. We are actively working to shrink the list and ultimately remove it.
 
All of this represents a tremendous amount of work with a material gain for Chrome SSL users. We hope that the data will be confirmed by other browser vendors and adopted more widely.