https://gustav.ernberg.se/tags/tls/ Recent content in Tls on Gustav Ernberg von Heijne https://gustav.ernberg.se/Gustav-Ernberg-von-Heijne-640.jpg https://gustav.ernberg.se/Gustav-Ernberg-von-Heijne-640.jpg Hugo en-us Tue, 03 Feb 2015 20:57:28 +0000 https://gustav.ernberg.se/2015/02/why-you-should-not-use-the-onedrive-shorten-url-feature-right-now/ Tue, 03 Feb 2015 20:57:28 +0000 http://gustav.ernberg.se/?p=19 <p><strong>Update 2016-10-20:</strong> Microsoft finally fixed this issue.</p> <p><strong>TL;DR; The shorten URL feature does not use encryption.</strong></p> <p>I am currently working as a software engineer developing with a web based B2B solution when I came across something interesting when performing some security analysis of the application.</p> <p>A part of the application is to enable people within an organization to share information with each other and this will naturally lead to users linking to external resources. The application is HTTPS/TLS secured and all the external resources used at the moment resides on HTTPS/TLS secured servers. However, examining the links added by users I discovered somthing unsettling: <em>Microsoft is not using SSL on their OneDrive URL-shortening service.</em></p>