Ars Technica reports that tens of thousands of HTTPS-protected websites—8.4 percent of the world’s top one million sites—as well as mail servers and other Internet services are currently vulnerable to a newly discovered attack that allows adversaries to eavesdrop on communications and downgrade encryption levels. The vulnerability, called Logjam, resides in the transport layer security protocol used by mail servers and websites to encrypt connections with users, the report states, and is a result of export restrictions mandated by the U.S. government in the 1990s so agencies could break foreign users’ encryption. “Logjam shows us once again why it's a terrible idea to deliberately weaken cryptography, as the FBI and some in law enforcement are now calling for,” said one researcher.
Full Story