The Illinois Commerce Commission websites do not use OpenSSL

http://www.icc.illinois.gov/

by mercurialshark • 12 years ago

14 20 12 years ago

icc.illinois.gov

cjfont• 12 years ago

So what? Depending on whether they're simply hosting public information and there's no need for authentication, why would they need SSL?

ams6110• 12 years ago

Even if I'm not submitting authentication credentials or other sensitive informtation, if I'm looking up something at a .gov I'd like to be sure I'm actually talking to the real website.

beat• 12 years ago

There are other implementations besides OpenSSL.

mercurialshark6• 12 years ago

They could clarify. Besides, it doesn't look like there is any form of SSL being used. Correct me if I'm wrong.

ma2rten• 12 years ago

consider yourself corrected.

https://www.google.com/search?q=site%3Awww.icc.illinois.gov+...

evidencepi• 12 years ago

Is that a joke?

nolok2• 12 years ago

People seem to be missing that they have a private account part, protected by ssl, probably for services aimed at business owners. That's the reason for this notice.

And the author of this thread's title is wrong, the fact that they don't use OpenSSL does not mean they do not use SSL at all (as proved).

mercurialshark6• 12 years ago

As pointed out below, even if you are not authenticating or transmitting data through sign in, you would still like to know if you are talking to the .gov site. Also, while they use SSL for authentication, they don't clarify via banner.

Moreover, the login is for attorneys representing businesses, so there is potentially even more at stake. Yes, they would like to know they are actually talking to the .gov site.

ChrisGaudreau• 12 years ago

Looking around the site, it appears that they do use SSL for parts that require authentication. They may simply be using a different implementation of SSL.

wglb3• 12 years ago

Server: Microsofg-IIS/7.0 Set-Cookie: ASP.NET_SessionId=... X-Powered-By: ASP.NET

Thus, it is SChannel.

And the title is wrong--the site says "Did not use OpenSSL".

mercurialshark6• 12 years ago

Indeed. They could clarify rather easily. Not using OpenSSL doesn't imply that they are secure, nor does it explain what they are using for the non-technical attorneys on the site...

ntakasaki3• 12 years ago

Not using OpenSSL doesn't imply that they are secure

Uhh, it does mean that they are secure from the HeartBleed bug. I think you're confused, OpenSSL is a piece of software, SSL is a protocol with multiple implementations. So it's possible to use SSL without using OpenSSL, hence the title of this post is completely wrong.

wglb3• 12 years ago

Ok, so the non-technical attorneys on the site are going to know what SChannel is? I think not.

I think their statement is fine.

mercurialshark6• 12 years ago

I stand corrected. My lessor points on only the authentication portion of the site don't justify the title, that I would correct if I could. Thanks, let's let this go the way of the Boskop...

The Illinois Commerce Commission websites do not use OpenSSL

Related Stories