The Lighter Side Of The Cloud – What Next?
The Lighter Side Of The Cloud – The Consultant
The Lighter Side Of The Cloud – Music Collection
The Lighter Side Of The Cloud – Dark Clouds
The Lighter Side Of The Cloud – Elastic Clouds
Understanding Twitter’s Security Enhancements

Understanding Twitter’s Security Enhancements

Understanding Twitter’s Security Enhancements

Last week Twitter announced a significant security enhancement – enablement of forward secrecy on twitter.com, api.twitter.com, and mobile.twitter.com domains. The prime objective of this change is to deprive hackers of an important exploitation tool.

Why was this necessary?

In the past 18 months, Twitter, akin to many other social network companies, has come under several cyber attacks by hacking community. Though not publicly acknowledged, some of them may have lead to data breaches as well. attacks-twitter

Also in between a new adversary has emerged in the form of Govt. assisted programs like NSA. It is now widely believed that such programs have collected user data without consent or knowledge of companies.

Quite naturally these social network companies are concerned about the breach of users’ privacy and data. In addition to downtime or data loss the biggest risk from such attacks is loss of reputation and the trust of millions of subscribers. No business can afford to ignore concerns of such a large number of users and hence action was imminent.

How would forward secrecy help

It is a common practice that an adversary would capture the targets network traffic and mine it for crucial information. Plain text (i.e. not encrypted) traffic can be very easily skimmed for passwords and other PIIs. So Twitter and other companies decided to switch to HTTPS which meant that network traffic was travelling in an encrypted form.

But even this was not enough especially when the company used a limited set of secret keys to encrypt the traffic. Once the adversary obtained one or more such secret keys they could de-crypt the whole traffic captured earlier. To circumvent this risk Electronic Frontier Foundation (EFF) recommended the site to implement Forward Secrecy or also known as Perfect Forward Secrecy (PFS).

In forward secrecy the session keys used by servers are truly ephemeral. Twitter implemented it by enabling the EC Diffie-Hellman cipher suite. In this scheme the client and server manage to come up with a shared, random session key without ever sending the key across the network, even under encryption.

Due to this it becomes extremely difficult (though when it comes to security nothing is impossible) to de-crypt previously captured traffic and also does not help in guessing future encryption keys.

Is this all Twitter would have done towards improving security?

The recent announcement will help strengthen user confidence and stop them from exploring other options. The EFF had recommended implementation of additional security features like HTTP Strict Transport Security; secure cookies, encryption of data center links, STARTTLS, and certificate pinning and Twitter is doing good on that front.

Forward secrecy largely affects the traffic in transit, one of the three broad areas where security lapse can occur.

Another set of changes concern end users directly. HTTPS is something that end users might have noticed on their browser. Earlier in May this year twitter introduced improved login verification using two factor authentication.  They also educate users on improved secure practices.

Finally Twitter must have taken measures for better in-house handling of data. Organization security policies and practices, cloud base backup and recovery plans and procedures or physical security come into ambit. This is something that only internal employees might have been informed about.

Does this all make Twitter future safe?

Not really. Security is always a dynamic system. Something that seems secure today may become vulnerable tomorrow. Not so long ago HTTPS alone was considered safe. These steps may be sufficient for now, but surely will get revisited in future.

Twitter thus joins other cloud companies like Facebook, Google and Dropbox in implementing these measures. With all leading cloud companies implementing it, soon this will become the default level of security.

By Manoj Tiwari

Follow Us!

CloudTweaks

Established in 2009, CloudTweaks.com is recognized as one of the leading authorities in cloud computing information. Most of the excellent CloudTweaks articles are provided by our own paid writers, with a small percentage provided by guest authors from around the globe, including CEOs, CIOs, Technology bloggers and Cloud enthusiasts. Our goal is to continue to build a growing community offering the best in-depth articles, interviews, event listings, whitepapers, infographics and much more...
Follow Us!

Sorry, comments are closed for this post.

Recent

Mobile Connectivity Rises – 24 Billion Networked Devices By 2019

Mobile Connectivity Rises – 24 Billion Networked Devices By 2019

Mobile Connectivity Rises Mobile Technologies such as BYOD, Wearable Technology and Internet of Things are the cornerstone to strong cloud computing adoption and will continue to be the case as the number of connected devices continue to climb. In May 2015, Cisco released the complete VNI Global IP Traffic Forecast, 2014 – 2019. Global highlights…

9 Pitfalls of Providing Cloud-Based Online Government Services

9 Pitfalls of Providing Cloud-Based Online Government Services

Cloud-Based Online Government Services Pitfalls When the US government designed the Affordable Care Act, a key part of the program was to encourage enrollment through the Healthcare.gov website. This online service was supposed to make it easier for citizens to learn about the ACA, compare their health insurance options, and take full advantage of this…

IOT, Intelligent Sensors, And The Change That Is Coming…

IOT, Intelligent Sensors, And The Change That Is Coming…

Intelligent Sensors And The Future What is or isn’t connected: In the end, that is the internet of things. They, the things, represent stuff that has been around for the past 30 years. It was only recently that we have developed a way to consistently connect those devices. Despite the increasing awareness of IoT, it…

Popular Archives

The Growth Of Rampant Digital Diseases

The Growth Of Rampant Digital Diseases

Rampant Digital Diseases Keeping ‘Rombertik’ at Bay – The New Malware that Destroys Hard-Drives A new form of malware is still on the loose, and this one takes malicious to a whole new level. Nicknamed ‘Rombertik’ by Cisco Systems, the malware attempts to infiltrate the victim’s browser to procure confidential information; fairly standard operating procedure…

Wearable Tech – Will It Ever Be Fashionable?

Wearable Tech – Will It Ever Be Fashionable?

Wearable Tech – Will It Ever Be Fashionable? Wearable tech is taking over the world, and in that sense, it’s already fashionable. As we noted last week, the sector is expected to grow from $14 billion in 2014 to $70+ billion in 2024. But what about ‘high-fashion’? The catwalks and runways of London, Paris, and Milan? Can…

Sponsors

The Many Hats Of Today’s IT Managers

The Many Hats Of Today’s IT Managers

The Many Hats of IT Managers In years past, the IT department of most large organizations was much like a version of Middle Earth: a mysterious nether world where people who seemed infinitely smarter than the rest of us bustled around, speaking and typing languages that appeared indecipherable, yet, which made our world work. They…

Selling Your Business To Your Employees

Selling Your Business To Your Employees

Mobility For Your Employees It may seem a radical notion, the idea of selling your business to the people who work for you, but this is the era in which we now work. Employees of all levels are all incredibly aware of their options when it comes to mobility and employability. This doesn’t mean that…

Established in 2009

CloudTweaks is recognized as one of the leading influencers in cloud computing, big data and internet of things (IoT) information. Our goal is to continue to build our growing information portal, by providing the best in-depth articles, interviews, event listings, whitepapers, infographics and much more.

CloudTweaks Comic Library

Advertising