{"id":26959,"date":"2014-10-23T14:41:02","date_gmt":"2014-10-23T18:41:02","guid":{"rendered":"http:\/\/www.opensource.im\/?p=26959"},"modified":"2014-10-23T14:41:02","modified_gmt":"2014-10-23T18:41:02","slug":"apple-dumps-ssl-3-0-for-push-notifications-due-to-poodle-flaw","status":"publish","type":"post","link":"https:\/\/euvolution.com\/open-source-convergence\/encryption\/apple-dumps-ssl-3-0-for-push-notifications-due-to-poodle-flaw.php","title":{"rendered":"Apple dumps SSL 3.0 for push notifications due to Poodle flaw"},"content":{"rendered":"<p><p>  Apple will switch to the TLS encryption standard after disclosure  of vulnerability that could expose encrypted data.<\/p>\n<p>     CNET  <\/p>\n<p>    Apple said Wednesday it will stop supporting the encryption    standard Secure Sockets Layer 3.0 for its push notifications    service in response to a vulnerability identified earlier this    month in the aging protocol.  <\/p>\n<p>    Apple announced on its developer site that    it will switch on October 29 from SSL 3.0 to Transport Layer    Security (TLS), SSL's more modern, less vulnerable younger    sibling.     Disclosed earlier this month, the vulnerability -- called    Poodle -- allows encrypted information to be exposed by an    attacker with network access.  <\/p>\n<p>    \"Providers using only SSL 3.0 will need to support TLS as soon    as possible to ensure the Apple Push Notification service    continues to perform as expected,\" Apple said in its bulletin.    \"Providers that support both TLS and SSL 3.0 will not be    affected and require no changes.\"  <\/p>\n<p>    To help developers test compatibility, Apple said it has    already disabled SSL 3.0 in the development environment on its    Provider Communication interface.  <\/p>\n<p>    Poodle, which stands for Padding Oracle On Downgraded Legacy    Encryption (PDF), is a problem    because it's used by both websites and Web browsers. Both must    be reconfigured to prevent using SSL 3.0, and Poodle will    remain a problem as long as SSL 3.0 is supported.  <\/p>\n<p>    Once the most advanced form of Web encryption in use, the    15-year-old SSL 3.0 is used by few websites anymore, according    to a study by the University of    Michigan. However, Poodle still poses a threat because    attackers can force browsers to downgrade to SSL 3.0.  <\/p>\n<p>    Twitter already notified its    users that it has disabled SSL 3.0 support, while Mozilla    advised Firefox    users to install a Mozilla security add-on that disables SSL    3.0. Along with Google and Mozilla, the University of Michigan researchers detailed    how to disable SSL 3.0 for Internet Explorer.  <\/p>\n<p>    Mozilla plans to disable SSL 3.0 in Firefox 34, the next version of the    open-source browser. It's currently in beta testing, with a    release planned for the end of November. Mozilla has been    testing the change in its Aurora version of Firefox, the    precursor to the beta version, and so far, \"There has been much    less screaming about this than I anticipated,\" said Mozilla's    Martin Thomson on Wednesday, discussing the change on    Mozilla's bug-tracker. Complaints would come from people who    couldn't use Web sites that required SSL 3.0.  <\/p>\n<p><!-- Auto Generated --><\/p>\n<p>See the rest here:<br \/>\n<a target=\"_blank\" href=\"http:\/\/www.cnet.com\/news\/apple-dumps-ssl-3-0-for-push-notifications-due-to-poodle-flaw\" title=\"Apple dumps SSL 3.0 for push notifications due to Poodle flaw\">Apple dumps SSL 3.0 for push notifications due to Poodle flaw<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p> Apple will switch to the TLS encryption standard after disclosure of vulnerability that could expose encrypted data. <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[45],"tags":[],"class_list":["post-26959","post","type-post","status-publish","format-standard","hentry","category-encryption"],"_links":{"self":[{"href":"https:\/\/euvolution.com\/open-source-convergence\/wp-json\/wp\/v2\/posts\/26959"}],"collection":[{"href":"https:\/\/euvolution.com\/open-source-convergence\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/euvolution.com\/open-source-convergence\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/euvolution.com\/open-source-convergence\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/euvolution.com\/open-source-convergence\/wp-json\/wp\/v2\/comments?post=26959"}],"version-history":[{"count":0,"href":"https:\/\/euvolution.com\/open-source-convergence\/wp-json\/wp\/v2\/posts\/26959\/revisions"}],"wp:attachment":[{"href":"https:\/\/euvolution.com\/open-source-convergence\/wp-json\/wp\/v2\/media?parent=26959"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/euvolution.com\/open-source-convergence\/wp-json\/wp\/v2\/categories?post=26959"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/euvolution.com\/open-source-convergence\/wp-json\/wp\/v2\/tags?post=26959"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}