Search Engines Leak?

Quote:

---

Google, Yahoo, Microsoft's Bing, and other leading websites are leaking medical histories, family income, search queries, and massive amounts of other sensitive data that can be intercepted even when encrypted, computer scientists revealed in a new research paper.

---

Quote:

---

Researchers from Indiana University and Microsoft itself were able to infer the sensitive data by analyzing the distinct size and other attributes of each exchange between a user and the website she was interacting with. Using man-in-the-middle attacks, they could glean the information even when transactions were encrypted using the Secure Sockets Layer, or SSL, protocol or the WPA, or Wi-fi Protected Access protocol.

---

Interesting article here:

http://www.theregister.co.uk/2010/03...acks_web_apps/

:)

Quote:

---

The threat is significant because it stems from fundamental characteristics of software-as-a-service applications that have been in vogue for about a decade.

---

Purdy scary stuff...

Quote:

---

Effective and efficient mitigations have to be application-specific: developers will need to identify the vulnerabilities first, and then specify mitigation policies accordingly," the researchers wrote. "This effort requires analysis of web application semantics, information flow and network traffic patterns."

---

Patterns...I love patterns :)



MLF