How to Protect Yourself From Certificate Bandits

There have been two major Certificate Authority (CA) attacks this year. In March, a hacker with success penetrated 1 of the largest CA's happening the Web–Comodo–and managed to progeny bogus certificates to himself (including unitary for Yahoo). The second omissible took place this week when a Dutch CA, Diginotar, was compromised and a count of fake certificates were issued.

Then how does a Certificate Authority attack work? Credential bandits break into companies–such atomic number 3 Comodo and Diginotar–that issue digital certification that your browser uses to verify a internet site's identity. This credentials tells your browser that the site can be "trusted," i.e. that it's not dangerous. Certificate bandits, yet, can undermine this entire process by issuing fake certificates to themselves that allow them to masquerade every bit "safe" sites, such as Google, Mozilla, Skype, and AOL.

Here are four ways you can protect yourself from hackers wielding fraudulent certificates.

1. Keep your browser adequate day of the month.

Browser makers are quick to react to news of CA hacks, and block them by pushing verboten fixes to their products. Though some browsers do this with automatic updates, others require non-automatic updating. Know how your browser updates itself (or, doesn't) and make sure you're running the in vogue version of the program. The faster your browser is updated, the faster hackers bequeath exist thwarted.

2. Enable certificate revocation in your browser.

In some browsers, certificate revocation or certificate status checking is turned off by default. If this is the case, turn it on. When a Ca detects a problem certificate, it leave revoke the credential. The solitary way your web browser can determine if a certificate has been revoked–and admonish you about it–is if the status checker is activated.

3. Custom-make the theme certificates in your browser.

Most browsers include a number of "root certificates" in them by default. Such credential play blanket permissions to accept all the certificates from a CA. For example, in the Recent DigiNotar case, a root certification for that CA installed on a web browser would allow whatever certificates issued by the CA to be automatically trusty—even cook ones. Recognizing that, the major web browser makers—Microsoft, Mozilla and Google—fleetly distant the DigiNotar tooth root certificate from their products. In some browsers, you can manually handicap root certificates, although this may push your technological understanding and patience. There behind be more than 100 roots in a browser and redaction the entrust settings in each nonpareil can be very time consuming.

4. Ever look for the green bar inside your web browser's address bar.

That's a sign-language that the certificate for the URL in the address bar has been subjected to an "outstretched proof" mental process. Non complete websites have them, but many high-profile sites practise. "That's your assurance that the credentials holder has gone done a very rigorous, registered cognitive process of authentication and vetting," Symantec Technical Director Rick Andrews explained to PC World. "Past definition EV certs can't equal instantly issued. They take up to be vetted by humans."

Follow freelance technology writer John P. Mello Jr. and Today@PCWorld on Twitter.