HTTPSafety.Check™

Ensure the Strength of Encrypted Communications

Not all secure sites are created equal. A vast number of web servers that offer weak encryption are vulnerable to attack making protected data transfer exposed to prying eyes. Pearl Echo’s HTTPSafety.Check™ blocks sites that don’t maintain a current and strong level of encryption, ensuring a safer browser experience.

 

 

When a browser and a web server negotiate a secure (HTTPS) connection, the two endpoints will exchange a security protocol or do a “downgrade dance”. In the first iteration, the most secure protocol supported by the browser is offered. If this fails, a weaker protocol is offered by the browser until a common protocol can be established. This mechanism is designed for the sake of interoperability. If an attacker has control of this negotiation, the browser may be forced to downgrade to SSL 3.0, for example, which has design vulnerabilities and exposes the site to an attack. The POODLE attack (which stands for "Padding Oracle On Downgraded Legacy Encryption") demonstrates how an attacker can exploit this vulnerability in order to decrypt and extract information from inside an encrypted transaction.

The negotiated connection happens behind the scenes. The typical user is comforted by seeing a safety padlock in the browser address bar but, in reality, has no indication of the site’s level of security. HTTPSafety.Check prevents the downgrade dance from proceeding to the point of vulnerability. Since Pearl Echo has never been a one-size-fits-all solution, the ability to override a blocked HTTPS site has been built into Echo’s HTTPSafety.Check solution.

You can easily test the security of an HTTPS site by using SSL Labs’ server test.