Feeds

Twitter fires up stronger, anti-snooping encryption for its millions of twits

Crypto-boffinry to keep network traffic secret even if private keys swiped

High performance access to file storage

Twitter says it has rolled out stronger encryption to safeguard its users' connections from eavesdroppers.

The micro-blogging ad-pusher said it has switched on "forward secrecy" for traffic to and from its desktop and mobile websites and its app interface; this goes beyond the protections afforded by traditional HTTPS.

Specifically, Twitter says it is now using the Elliptic Curve Diffie-Hellman (ECDHE) cipher suites. Simply put, these attempt to thwart a third party from decrypting intercepted network packets even if Twitter is later compromised or pressured by g-men into hand over its private keys. This is done by generating a randomized per-session key that's shared between the browser (or app) and Twitter's servers without them exchanging the key in full, even encrypted.

"On top of the usual confidentiality and integrity properties of HTTPS, forward secrecy adds a new property," Twitter security engineer Jacob Hoffman-Andrews said in a blog post.

"If an adversary is currently recording all Twitter users’ encrypted traffic, and they later crack or steal Twitter’s private keys, they should not be able to use those keys to decrypt the recorded traffic."

According to Twitter, as much as 75 per cent of its internet traffic is already established using ECDHE; the remaining 25 per cent comes from older third-party clients that do not support the key agreement protocol.

While Twitter did not mention the NSA specifically, the company underscored the need of users to maintain strongly secured connections and protect against possible surveillance by a third party that could tap into a network or listen in on a session.

Such snooping tactics were found to have been employed by the NSA to collect data from the internet's backbone fibre cabling and the lines connecting major data centers. In the wake of NSA whistleblower Edward Snowden's revelations, a number of web service providers are stepping up encryption on their packets.

Hoffman-Andrews suggested that the use of security protocols such as those introduced by Twitter should soon become the standard for security protection online. He urged other web application developers to consider placing similar protections on their own sites.

"At the end of the day, we are writing this not just to discuss an interesting piece of technology, but to present what we believe should be the new normal for web service owners," he said,

"A year and a half ago, Twitter was first served completely over HTTPS. Since then, it has become clearer and clearer how important that step was to protecting our users’ privacy." ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.