The view from the top of IT with TechWorld Editor Rohan Pearce
SSL, or Secure Sockets Layer, is the "great enabler" of online
commerce. It's the S in HTTPS, and it's the padlock in the
address bar of your browser. It's the underlying protocol which
stops the cybercrooks enjoying a complete free-for-all when you
spend money or read your email online. Together, SSL and its big
brother Transport Layer Security (TLS, which is SSL with a beard
and in grown-up clothes) provide a ubiquitous cryptographic
mechanism by which two people on the internet, including people
who have never met or done business with each other before, can
exchange information with secrecy, authenticity and integrity.
Loosely speaking, that means they can verify that they really
are talking to each other, not to an impostor; that no-one else
is eavesdropping; and that no-one can tamper with the content of
their conversation. In sequence, these SSL-related disaster
stories involve: the prevalent server-side implementation of
SSL/TLS in a crypt