Secure Socket Layer encryption for delivering your site over HTTPS.

We provide encrypted connection to our client’s sites using modern cryptography of TLS (Transport Layer Security) SSL certificates, scoring well over the 80^th percentile range in all four major SSL category rankings (Certificate, Protocol Support, Key Exchange, Cipher Strength).

If your traffic isn’t encrypted, eavesdroppers could watch what’s going on in that network communication. If you have a man-in-the-middle-attack, you’ll have confidentiality risk – your traffic could be observed. Moreover, you’ll also have no integrity, the man in the middle could manipulate the content, an example would be changing the function of a form such that when someone logs in with their credentials, the form posts it to another server. Anything not loaded over an https connection cannot be fully trusted. The other thing is that people won’t have confidence in the authenticity of the site they are visiting if that site is not loaded over an https connection because they won’t know whether that site they’re visiting is legitimate or not because it doesn’t have to present an SSL certificate to verify itself.

We use servers that support TLS_FALLBACK_SC SV to prevent protocol downgrade attacks.

Please note: our sites inly work in browsers with Server Name Indication (SNI) support. SNI is an alternative to how we used to always stand up SSL, which was an IP based SSL, where you had to always have an IP address for each certificate. Importantly, SNI works in almost everything fantastically, but it is worth noting that there are some legacy browser and operating system combinations that this won’t work on. As an example, internet explorer 8 on Windows XP cannot work with SNI SLL. However, this combination is almost nonexistence today.

Understanding Transport Layer Risk (where SSL is a good use case for protection):

Rogue Wi-Fi

One of the risks that’s you face is a visitor using a rogue network. Rogue for example could mean that the free café Wi-Fi you connect to could be saving all the packets that go back and forth. It could also be that someone setup a malicious Wi-Fi deliberately and called it free so that people use it, and use that to intercept the network. A more malicious style of attack could be using a device such as a Wi-Fi pineapple, which tricks people to connect to it without them actually consciously connecting to the network – their devices just suddenly connect to the pineapple and start sending all the traffic through it.

DNS hijacking

Many attacks have been seen in the past where the DNS settings on devices such as routers or PCs are hijacked such that the name resolution is pointed to another server. The client is connecting to a name that it trusts, but that traffic is routed through to an attackers’ server. This is another case where SSL brings authenticity to your site.