on 28-Oct-202113:42 - edited on 11-May-202214:12 by LiefZimmerman
The 2021 TLS Telemetry Report written by Dave Warburton with additional contributions from Sander Vinberg is now live!
The report is based on data collected by F5 Labs' own free, open-source TLS scanning tool, Cryptonice. Security teams and website operators can use this tool to evaluate the cryptographic posture of their own sites and even incorporate the tool into their DevSecOps workflows for fully automated HTTPS auditing. This year's report also includes relevant stories from the past 18 months illustrating how lapses in TLS have resulted in real-world consequences.
"The desire to intercept, weaken, and circumvent encryption has never been greater. Nation-states and cybercriminals alike are attempting to work around the problems caused by strong encryption. While this rarely results in direct attacks against cryptographic algorithms or protocols, it often leads attackers to instead think of creative ways to intercept or capture information before or after it has been encrypted. With these risks ever-present, it has never been more important to focus on strong and up-to-date HTTPS configurations, particularly when digital certificates are shared across different services."
Some highlights from this year's report include,
The move to elliptic curve cryptography is slow but steady, with 25 percent of certificates now signed with the Elliptic Curve Digital Signature Algorithm (ECDSA) and over 99 percent of servers choosing non-RSA handshakes when possible.
Despite widespread TLS 1.3 adoption, old and vulnerable protocols are being left enabled. RSA handshakes are allowed by 52 percent of web servers, SSL v3 is enabled on 2 percent of sites, and 2.5 percent of certificates had expired.
Encryption continues to be abused. The proportion of phishing sites using HTTPS and valid certificates has risen to 83 percent, with roughly 80 percent of malicious sites coming from just 3.8 percent of the hosting providers.
