Is IBM Cloud Blumix insecure ?

<div dir="ltr" style="text-align: left;" trbidi="on"> <div> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0-WaNEDO6AXAm3Ym8BB067AYfipaSRdX1H7ejEHJK_o0nLbpSeekz1IHr6IcY1ai2IaVWUIMpZRgP0SFPiXjwghWRdhIY4ELsRDE2PqtHA9QuTA-axzW-pkS_nAyYeQbzjRNPuqKg4uk/s1600/ibm+insecure.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="399" data-original-width="1103" height="228" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0-WaNEDO6AXAm3Ym8BB067AYfipaSRdX1H7ejEHJK_o0nLbpSeekz1IHr6IcY1ai2IaVWUIMpZRgP0SFPiXjwghWRdhIY4ELsRDE2PqtHA9QuTA-axzW-pkS_nAyYeQbzjRNPuqKg4uk/s640/ibm+insecure.jpg" width="640" /></a></div> <br /> An e-mail has gone out from IBM about its Bluemix cloud: after next Tuesday, the SoftLayer APIs will no longer accept connections encrypted with the ancient TLS 1.0.</div> <div> It's not <i>quite</i> a surprise that the 1990s-era protocol was still accepted: a great many services are still midway through their deprecation plans.</div> <div> To give just one example, Salesforce <a href="https://help.salesforce.com/articleView?id=TLS-1-0-Disablement-Critical-Update-Console-CRUC-Setting&type=1" rel="nofollow" target="_blank">began</a> its phase-out of TLS 1.0 in production instances on July 22, 2017.</div> <div> And the PCI Council, which had originally wanted TLS 1.0 gone last year, had to extend its deprecation date to 30 June 2018 (and it's still <a href="https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls" rel="nofollow" target="_blank">blogging </a>early warnings for members, in case they're still failing to catch up).</div> <div> In the Bluemix e-mail, IBM notes: “There should be no impact to customers using a modern web client. This notification is intended to be informative only.</div> <div> The two services affected by the depreciation are api.softlayer.com and api.service.softlayer.com – so there's another community that's got to pay attention, namely developers who wrote to the APIs and used TLS 1.0 to secure their API access.</div> <div> TLS 1.0 has long been known as insecure, as far back as 2011 when it was bitten by the BEAST exploit. ®</div> </div>

Encryption Hacking News IBM Is IBM Cloud Blumix insecure ?

An e-mail has gone out from IBM about its Bluemix cloud: after next Tuesday, the SoftLayer APIs will no longer accept connections encry...

Read more »