Ask your host whether SSL 3.0 is switched off on the servers behind your secure pages, control panel and webmail, with TLS left on. Very old browsers lose access; every other visitor is better protected.

A notice from the host about SSL 3.0

Since Tuesday, hosts have been writing to customers about a flaw called POODLE. The messages say the same thing: SSL 3.0 is being switched off, and a few very old browsers may stop reaching secure pages.

SSL 3.0 is an old version of the protocol behind the padlock in the address bar. Newer versions, called TLS, replaced it long ago, but servers and browsers kept it as a fallback for old software.

That fallback is the weakness. If your site has a login, a checkout or a form on secure pages, ask whether the old protocol is now off where your site lives.

What the flaw lets an attacker do

The attack needs someone on the same network as the visitor, such as open Wi-Fi in a cafe. The attacker interferes with the connection until the browser gives up on TLS and retries with SSL 3.0.

SSL 3.0 is loose about the padding at the end of each encrypted block. By making the browser send similar requests over and over, the attacker can work out a secret one character at a time.

The usual target is the cookie that keeps a visitor logged in. With it, the attacker can act as that visitor without ever learning the password.

Questions to ask your host

Most small business sites run on shared hosting, where the host controls the server settings. Ask in writing, and keep the answer with your site records:

Owners tend to skip the third question. The people who look after a site log in from laptops on all kinds of networks, and need the same protection as customers.

Which browsers lose access

Every current browser can use TLS, and so can most older ones. The main exception is Internet Explorer 6 as it came on Windows XP, with TLS switched off by default.

Once a server refuses SSL 3.0, that browser cannot open the secure pages at all. Some very old phones and devices are in the same position.

Your visitor reports can show whether this matters. The browser report in Google Analytics lists versions; if Internet Explorer 6 appears, note which pages those visits reached.

A worked example

A scale calibration company with five technicians certifies truck, warehouse and shop counter scales across the Cariboo. Customers log in to its website to download calibration certificates before inspections.

Its host wrote on Wednesday that SSL 3.0 would be switched off that night. The office manager checked the browser report and found a handful of logins from Internet Explorer 6.

They came from two customers, a gravel yard and a feed mill, each with an old computer in the scale house kept for one weighing program.

She called both that afternoon. One ticked the box for TLS in the browser's advanced settings; the other began downloading certificates from a newer computer in its office.

The host switched SSL 3.0 off as planned. Beside the login link on the ordinary pages, a line now names the supported browsers and gives the office number.

With SSL 3.0 gone from the server, there is nothing left to fall back to. Every customer reaches the certificates over TLS, and an attacker on a shared network has no older protocol to force.

Nothing to reissue this time

Heartbleed in April let attackers read memory from servers, which is why certificates were reissued and passwords changed. POODLE attacks a connection while it is open and leaves the server's keys alone.

Your certificate does not need replacing, and there is no general reason to change passwords. The fix is a setting on the server, plus current browsers in the office.

Your own computers and browsers

The makers of the main browsers are moving to drop SSL 3.0, or to stop falling back to it. Most browsers update themselves, so leave automatic updates on.

Many offices keep one machine that never updates, for one old program. Keep it away from banking, the site's admin pages and anything else behind a login.

Staff who work from cafes and hotels are on exactly the networks this attack needs. A current browser matters most on their laptops.

Telling the few who are affected

If your customers include businesses with old equipment, a short notice before the change saves confused calls. Say which browsers will stop working, and what to use instead.

Put the notice beside the login link on ordinary pages, not on the secure page itself. A browser that cannot open the secure page will never show a message placed there.

Keep it practical: the browser to use, the setting to tick on very old machines, and a phone number. Nobody needs a lesson in protocols to download a certificate.

If you run your own server

A business with its own server, or a virtual server it manages, has to make this change itself, in the web server's settings and the mail server's.

Afterwards, an online server test will list the protocols the server accepts. SSL 3.0 should be missing from it.

The counter-case

Where a site has no logins, forms or checkout and serves every page over plain HTTP, POODLE changes nothing on the pages visitors see.

Its control panel and webmail still run over secure connections, though, so the host's change still protects the people who look after the site.

And for a business whose best customer still uses Internet Explorer 6, keeping SSL 3.0 on is the wrong answer. Helping that customer onto a newer browser protects them on every other site too.

Switching off the old protocol

  1. Ask your host whether SSL 3.0 is off.
  2. Confirm TLS stays on for every secure page.
  3. Include the control panel and webmail in the question.
  4. Check the browser report for Internet Explorer 6.
  5. Call the customers those visits point to.
  6. Add a line beside the login link.
  7. Keep office browsers updating themselves.

Step four turns a server change into a few phone calls rather than a stream of support requests, because the people affected hear about it before their pages stop opening.

April's flaw in the encryption software itself, when certificates did need reissuing, called for a longer routine, set out in Heartbleed and the padlock on your site.

Frequently asked questions

What is POODLE?

A flaw in SSL 3.0, an old protocol still used for secure pages. An attacker on the same network can force a browser down to it and read secrets such as login cookies.

Do we need a new SSL certificate?

No. Unlike Heartbleed in April, POODLE does not expose the server's private keys. The certificate stays as it is; the fix is a setting that switches SSL 3.0 off.

Should we change our passwords?

There is no general reason to. The attack targets connections while they are open, mainly the cookies that keep people logged in, not passwords stored on a server.

Which visitors will lose access?

Mainly people using Internet Explorer 6 on Windows XP with its default settings, and some very old phones and devices. Every current browser connects with TLS instead.

Does this matter if our site has no secure pages?

Less, for the pages themselves. Your control panel and webmail still use secure connections, so ask your host to confirm the old protocol is off there too.

Who makes the change?

On shared hosting, the host does, because it controls the server settings. A business that manages its own server has to change the web and mail server settings itself.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure what your secure pages accept?

Send us your login or checkout page's address, and we will check which protocols it accepts and what to ask your host.

Start a Conversation