The Security Skeptic

Privacy Awareness 101: Five easily remembered rules for protecting privacy

Privacy is a topic we love to talk about but make little effort to practice.

Practicing privacy is in fact hard to do. Not only is the Internet is an information sharing medium, it is strongly commercially influenced as well.  Commercial interests are well served by gathering data about user interests and behaviors: targeted marketing, promotions and even product evolution all benefit from private data collection. (For clarity,  "private data" in this post includes personal identifying information, details about one's personal life, purchasing and personal interests...)

The ART of Collecting Private Data

Generally, we distinguish whether private data collection is beneficial, harmful or intrusive to users by assessing whether it satisfies accountability, responsibility, and transparency criteria (See "ART" inset at right). Unsurprisingly, public and comercial interest groups have conflicting views of how accountable, responsible and transparent data collection must be.   Conflicts over privacy have become too routine and they often follow a similar course. A data collector publishes or changes a privacy practice and is criticized as behaving intrusively (Facebook, Google), or a third party discloses a data collecting behavior that is condemned as abusive (CarrierIQ). Privacy advocacy groups raise awareness and either insist on change or lobby for legislation that would require greater transparency and accountability from data collectors.   In parallel, grass roots efforts by online safety and awareness raising organizations and experts advise users of privacy threats. These are valuable but they often follow the same methods and practice that the plethora of virus or malware removal articles.

ART Consent. Is the user asked to consent to the collection and use of private data? Notice. Is the user aware that private data are being collected? Purpose. Why are private data being collected? Extent of use. How will the collected data be  used, by whom, for how long? Remanence. What will be done with the data when it is no longer useful?

While answering the "how" they fail to capitalize on the opportunity to drive home basic or first principles for private data protection. These are lost amid the many detailed explanations for adjusting privacy settings, installing browser plugins, and similar measures. Bombarding users with information overly complicates awareness raising.  

Simplify the privacy message

Think of these principles as you prepare privacy awareness messages or training:

1. Sharing is the opposite of "keeping private". There is no corollary to whispering a secret to a friend in cyberspace. Once you share or disclose any bit of information in cyberspace it is potentially public and will remain so forever.
    
2. "Free" almost always comes at a cost to your privacy. Data collectors and social pressures make the temptation to accept free service in exchange for giving up personal data extremely hard to resist. If you can't resist, at least enter the contract with eyes wide open: there are virtually no circumstances where a giveway, free access or free use of an Internet service or social media site comes free.    
    
3. Knowledge is power. Boring as they may be, read the terms of use (terms of service) and privacy policies, at least to the point where you know whether you are consenting to third party sharing of your private data, conceding copyrights to your work, or agreeing for your private data (including photos) to be used for marketing purposes.
    
4. Respect for private data is critical to any commitment to share you make. Do some homework. Be confident that the party whom you are about to trust will respect your privacy before you share any information.
   
   
5.  Choose what you share wisely. There's no substitute or privacy setting that can  compensate for poor judgment. Ultimately, you are accountable or responsible for the benefits or harm resulting from what you say, share or reveal.

Encourage those you train, family members, and friends to take ownership of private data.

If you enjoyed this post, you may want to read There Are Only Three True Privacy Threats.

In search of... Foreign Language Spam Filter for Apple Mail (Mail.app)

Foreign language spam is a problem everyone shares, not just folks who read English. If you don't understand a language, and can't read the characters of the script used, you probably won't get much value from messages you receive. Worse, you won't understand the "text" of the links embedded in the message.

Common sense would dictate that you don't click on something you can't read but decades of evidence proves otherwise.  A practical solution to foreign language spam is to prevent it from appearing in your In Box.

If you are an Apple Mail (Mail.app) user, and your organization isn't filtering foreign languages at a mail server or antispam gateway, you'll find that filtering foreign spam is problematic for several reasons. First, there are thousands of languages. Many of these can be written using characters from one or more scripts and many of these can be encoded using  one of (again) many character sets. I receive mail daily composed using Arabic, Chinese, Russian, Japanese, and Korean. Examining the raw source email  From: and Subject: headers of these messages reveals they are encoded using UTF-8, windows-1251, GB18030 iso-2022-jp, KOI8-R, respectively. Filtering based on  these encodings alone is a messy Mail Rule.  

Filtering based on the "language" found in email messages has similar scaling and messiness issues. The problem is compounded by the fact that email messages encoded to support languages that are not represented using 7 bit ASCII can also have multiple body "parts" (as well as attachments) . Body parts are typically distinguished and bounded by the use of Content-Type: headers. Apple's Mail.app seems to examine only the first encountered of this header type, which is often (perhaps intentionally by spammers) multipart/alternative or multipart/mixed so a rule that is supposed to filter  text/plain; charset="windows-1251" as junk will fail to match.

I found a solution at Buzzdroid that works on the principle that certain words (of, the, and, is, a) are found in nearly any rationally composed English message body. Buzzdroi'ds logic is straightforward: if these words are not present, the message is probably not "readable English". A Mail Rule of this kind looks like this:

My variation to this theme (below) is working well, as the Junk folder illustrates:

This is an imperfect solution to be sure. For example, Exchange Calendar invitations match the rule. Tempting...  I created an exception rule "Calendar" and made certain the rule preceded the Foreign Language Spam rule.  Occasionally I receive email composed as if it were a text or Tweet and for these, I may whitelist the sender. After 10 days of testing, I'm happier with a 1 in 10 false positive in my Junk folder than the distraction of messages I cannot read in my In Box. 

As the Buzzdroid folks say, "Any Apple Mail Rule should only be the last line of defense against spam." This problem can be handled at mail servers or antispam gateways but there is an administrative cost for organizations with language diversity: while it might serve me to block all languages that do not use characters from Latin alphabets, many of my colleagues would be inconvenienced. 

I'm curious to hear from others whether a similar approach would work for other languages. If you come up with an Arabic, Chinese, Japanese, Korean, or Russian "only" Rule for Mail.app, let me know.

Twelve days of Phishmas - 2011

Phishers are thankful for how generous so many Internet users have been in 2011. As they did in 2009 and 2010,  carolers are filling IRC channels with the merry sounds of Phishmas anew!

Photo by Lucci Lugee Liyeung

On the first day of Phishmas, Twitter postmaster emailed me...

Kim Kardashian is following me!

On the second day of Phishmas, Western Union emailed me...

A wire transfer's waiting, and Kim Kardashian is following me!

 On the third day of Phishmas, the nice bank texted me...

We'll erase your debt, wire transfer's waiting, and Kim Kardashian is following me!

On the fourth day of Phishmas, a hottie sexted me...

Hi my name is Holly, we'll erase your debt, wire transfer's waiting, and Kim Kardashian is following me!

On the fifth day of Phishmas, an email came to me...

PLEASE VIEW THIS FLASH! Hi my name is Holly, we'll erase your debt, wire transfer's waiting, and Kim Kardashian is following me!

On the sixth day of Phishmas, my Facebook app told me...

You're naked in this photo, PLEASE VIEW THIS FLASH! My name is Holly, we'll erase your debt, wire transfer's waiting, and Kim Kardashian is following me!

On the seventh day of Phishmas, a follower tweeted me...

I have an iPad for you:-) You're naked in this photo, PLEASE VIEW THIS FLASH! My name is Holly, we'll erase your debt, wire transfer's waiting, and Kim Kardashian is following me!

On the eighth day of Phishmas, web.offi0e emailed me... 

3% Loan offer! I have an iPad for you:-) You're naked in this photo, PLEASE VIEW THIS FLASH! My name is Holly, we'll erase your debt, wire transfer's waiting, and Kim Kardashian is following me!

On the ninth day of Phishmas, PayPal emailed me...

My account's suspended, 3% Loan offer! I have an iPad for you:-) You're naked in this photo, PLEASE VIEW THIS FLASH! My name is Holly, we'll erase your debt, wire transfer's waiting, and Kim Kardashian is following me!

On the tenth day of Phishmas, a Russian pill gang promised me...

I won't need a prescription, my account's suspended, 3% Loan offer! I have an iPad for you:-) You're naked in this photo, PLEASE VIEW THIS FLASH! My name is Holly, we'll erase your debt, wire transfer's waiting, and Kim Kardashian is following me!

On the eleventh day of Phishmas, FTD offered me...

An exclusive offer! I won't need a prescription, my account's suspended, 3% Loan offer! I have an iPad for you:-) You're naked in this photo, PLEASE VIEW THIS FLASH! My name is Holly, we'll erase your debt, wire transfer's waiting, and Kim Kardashian is following me!

On the twelfth day of Phishmas, my sister in Christ begged me...

Help me heal my husband, an exclusive offer! I won't need a prescription, my account's suspended, 3% Loan offer! I have an iPad for you:-) You're naked in this photo, PLEASE VIEW THIS FLASH! My name is Holly, we'll erase your debt, wire transfer's waiting, and Kim Kardashian is following me!

Remember that phishers exploit email, text, and all forms of social media. During this holiday season, please remember to Stop, think, connect.

 

How to manage passwords with some, little, or no effort

One of the most important password use guidelines is to never use the same password for multiple logins. To practice this rule you must remember potentially dozens of passwords for sites you routinely visit. Few people can remember large numbers of password, though, so let's consider several ways that you can manage passwords. 

"Remember me"

A common practice for Internet users is to use whatever method web sites offer to help you remember the password you create when you next visit the site, such as a cookie. A cookie is a set of information about a user that a web site leaves on your computer. The web site reads this information when you next visit the site. When you choose Remember me or the equivalent at a web site during a login attempt, you give the site permission to save your identity and password in a cookie.

This option is ubiquitous and convenient; in fact, it's such a common practice that people actually write and publish scripts to force browsers to store passwords even for sites that prohibit it.

While convenient, this choice has certain risks and unknowns. Cookie characteristics like persistence and quality of encryption vary from site to site. Certain cookie implementations are vulnerable to theft by malware (e.g.,  ZeuS), poisoning, and session hijacking attacks . Since you can't be certain how every site deploys cookies, it's worthwhile to learn how sites you visit use them. If you are a convenience seeker, however, this is probably *not* something you are likely to do. 

 And frankly, you can do better.

"One password to remember them all..."

Rather than rely on cookies, consider securely storing the passwords for your many logins using a secure personal data or password manager. These best among these store all your passwords or personal data securely using strong encryption methods. Typically, the only password you must remember when you choose this alternative is the password you create that "opens" your encrypted passwords file. 

When you visit a site that challenges you for a password that you've stored, launch the password manager, and it will prompt you for the location of your encrypted file, and then prompt you for your "master" password. Keep your USB safe. Scan it routinely for malware (especially if you choose not to disable write access!). Many password managers are available. Consider trying the oft-recommended 1Password, KeePassX or MacOS Keychain services. Certain password managers are available for several devices and operating systems. By choosing one of these you will be able to use a familiar software, UI, and a common passwords file. If this is too much work, you can choose to not try to remember passwords at all, but instead make use of password reset features. I call this alternative...

Create a Password Manager Thumb Drive? Consider having your password manager create your encrypted passwords file on a removable drive rather than on your PC/Macintosh hard drive and install the software on the drive. You'll then be able to use the password manager on multiple systems.   Prepare the USB drive as follows. Securely erase and reformat (1, 2) a removable drive so that you begin with a data and malware free drive. Disable write access on the drive (3, 4 for Windows, 5 for Mac OS)  Finally, install the software on the hard drive, create a strong password (my article) for access to your passwords file, and enter your passwords. As a final step, back up the file(s) on a second removable media and store this backup copy in a safe location. Note: If you need to add passwords to the file, you can enable write access for this purpose then write-protect the drive when you are done. The same articles that explain how to disable write access explain how to toggle from read only to read/write. Warning! If you have a history of losing USB drives, however, you do risk that whomever obtains your drive may attempt to decrypt your password files using decryption or password cracking tools. You run this same risk, of course, if you lose your laptop.

Set, forget, reset: The Poor Man's One Time Password

When you first visit a site, create a strong password. Other than having to remember this string long enough to confirm the password you compose, don't bother to remember it at all. When you next visit the site, use the Forgot your password? feature, wait for the site to send reset instructions to the email you provided when you created your account, and then follow the instructions to create a new password.

This method emulates a one-time password system. Note that for many sites, you may not even have to remember your account ID. Before you dive headlong into this "free at last" strategy, recognize that there are some risks to relying entirely on this method. The site may change its password recovery practice. You may change or (by changing employers or email providers) lose access to an email address. Your email account might be hijacked. Thus, while set, forget and reset is not a bad strategy for sites you visit infrequently it is probably not the best choice for important sites such as your bank, or sites you frequently visit.

Closing Remarks

We all have far too much information to manage or remember. By adopting some form of password management, you not only prune what you need to remember, but you'll better protect yourself against impersonation.

There are only three true Internet privacy threats

What do Top Ten lists of Internet Privacy Threats have in common with US FBI Ten Most Wanted lists? Both attempt to keep the public aware of current, most egregious offenders. While these forms of warnings are helpful, they are limited in at least two ways.

Top Ten lists call attention to a small number of suspicious or bad actors. This may be effective in the case of fugitives or terrorists, but it is dangerously misleading for Internet threats, where privacy abuses are as prevalent among small time actors as any online presence that is visible enough to make the top ten. Simply put, when you tell Internet users “here are the folks to worry about”, you risk having them fail to consider the thousands of online presences where collection, misuse or mishandling of personal information is as much of a threat if not more so.

More importantly, Top Ten lists set users up to micro-manage privacy threats. Such lists distract Internet users from considering the meta-issue. They list the privacy concerns for social networks, mobile operators, subscription portals, emerchants and clouds. They explain in some detail how to opt-out, filter, restrict access, etc. This has the unintended consequence of convincing Internet users that protecting personal information involves a unique effort for each site they visit. The scaling properties of this kind of solution are poor for automation, and worse for the Human OS.

Teaching Internet users how to mitigate threats at a micro-level is useful. Offering Internet users first principles regarding privacy threats is essential.

Let's look at these more closely:

Private sector

Any non-government, commercial, not for profit, free or for fee site operator that posts or collects any information that is personal or sensitive in nature is a potential privacy threat. Only some of the private sector collects location, behavioral, or personal identifying information for the purpose of influencing or tracking you in some manner. 

Public sector

Any government agency that collects or publishes any information that is personal or sensitive in nature is a potential privacy threat. Government agencies may be more tightly regulated with respect to collection, storage, and sharing of personal data; however, regulations vary across governments and certain agencies within governments may have considerably more license to access personal data than others.

You

You are ultimately responsible for containment or leakage of data. Consider the following as a first principle for protecting your personal data: 

Whether private and public sector actors, it’s important to recognize that (i)  each stores personal data you disclose, (ii) you have little insight into how competently they protect your personal data, and irrespective of what filters or restrictions you may apply through some user interface, (iii) you don’t always know exactly how and with whom they share your data, and (iv) policies change.

Set aside the public outrage and clamor for better privacy controls, more transparency and accountability. These are important issues, but they won't help you on a day by day basis.  Apply this principle each time you have a choice to share or disclose anything you consider personal or sensitive. Using the best information available, judge whether you are truly comfortable how a site measures up to (i)-(iv). You won't achieve perfect privacy but you may have fewer moments of regret or embarrassment, and you may avoid falling victim to online predators.

If the best choice seems to be to not share or disclose, it probably is...

What's missing from security awareness programs? Human awareness

The central theme for many security awareness month articles is "Awareness programs are failures", quickly followed by a rally cry, "We need to change them." This is too vague an objective.

Think Differently

Lance Spitzner of Honeynets Project fame thinks we need to think differently if we truly hope to create effective programs. I agree. But there's more than merely  thinking differently to consider. We need to stop thinking in a vacuum.

Lance claims "To have an impact and secure the HumanOS, we have to start thinking differently about awareness and education." What I conclude from this comment and shared with Lance is that we need to admit that as security and technology professionals, we are ill equipped to develop effective security awareness programs without help from others. 

Our orientation to security awareness is shaped by what we know  about threats, risks, and exploits and the techniques and technology we can use to mitigate them. Security success often relies on knowing our enemy. We study their methods, means and motives. We track their behavior.

Know Your Friends

We know more about our enemies than our friends. This is our collective blind spot. Imagining that the people for whom we design security awareness programs have the same vested interest in, fascination with, or time to "be secure" is pure folly, hubris or both.  Our enemies, however, study our friends (our users): studying how users behave, observing how quickly user interactions with devices become rote, and teasig out what makes users act without thinking form the foundation of social engineering. 

Expand the Talent Pool

Success at raising security awareness rests on knowing our friends. We don't study  the HumanOS that the average Internet user boots up when he wakes as much as we study criminals or miscreants. Fortunately, others do. 

Sociologists study social activity. Psychologists study human behavior. Collectively, they study most of the critical functions of the HumanOS. Why are we not engaging experts in these fields to help raise security awareness? 

If we want to experiment with a psycho-social-technological approach to security awareness, perhaps we can start with social engineering. Social engineering is arguably the most widely used tool in the criminal tool kit. Social engineers have a distinct advantage on the ecrime playing field. They draw upon decades of exhibited Internet behavior and millennia of successful acts of fraud or deception. Often, with almost trivially simple technology they are able to steal, defraud, coerce, or impersonate with almost a free hand.

Security professionals know how criminals victimize users.  We offer "day late, dollar short" awareness programs of the form "here's how phishers steal your credentials, so don't fall for this kind of scam". This approach is as successful as telling people "eat fewer calories than you burn and you'll lose weight". Both are well-intentioned but ineffective because they unrealistically assume that the fix is obvious and changing behavior is easy.

Change Behavior not Software

Effective weight loss programs involve education, coaching, counseling or activites that are less oriented to helping individuals to manage anxiety, frustration, urges, or other reasons that cause them to make poor diet choices.

Weight loss programs aren't designed exclusively by physicians or scientists who study nutrition, and neither should security awareness programs be designed by experts who study social engineering or ecriminal activity. The same is true for healthcare awareness programs and month long campaigns. Breast cancer and heart disease awareness are noteworthy and effective examples. These effectively incorporate sociological and psychological considerations into awareness program designs. If we are unwilling to adopt similar orientations and strategies, we may continue to fail to make awareness programs effective. 

 

User tracking by Facebook, Twitter, and Gooogle

Social networks are free to use or visit. But free often comes with a price. While you don't necessarily pay with coin, you do pay with personal or behavioral data.

Christian Schneider has analyzed user tracking performed by popular social networks - Facebook, Twitter, Google+, and Xing. In his article, he demonstrates how "All tested major social networking websites have the ability to collect and mine data of users visiting social button enabled webpages". 

"Tell me something I don't know"

Christian studied cookie use associated with trending, popularity, and sharing buttons by social networks (Like, Tweet, +1). His findings? Social networks are able to track your surfing behavior when you are logged in and after you've logged out. Surprised a little? Christian also finds that even users who do not have an account at social networks can be tracked if they've visited a social network page. More surprised? Christian says, "All tested tracking capabilities do not require the user to actually click on the social button - just viewing a webpage with such a button is sufficient to trigger the request." 

All social networks Christian tested use a persistent (two year) cookie that is valid for the entire domain (any page at facebook.com, twitter.com, facebook.com...). At the very least, this allows these social networks to collect all the URLs you visit.  

It may seem like I've read you the last page of a murder mystery and you shouldn't bother to read the book. That would be a mistake. Christian discusses how tracking is done, including HTTP code snippets, in a clear and informative manner. He also discusses issues associated with manage these cookies. His attention to detail and deliberate style make  reading Tracking performed by social networks worthwhile even for folks who don't understand code. 

Turn off secure browsing?

I saw this message on Facebook for the first time today:



Pure speculation on my part ;-) but is that Facebook-ese for "Our app partner doesn't offer secure connections but that shouldn't surprise you because any security is meaningless to a company that wants to grab as much personal data from you as possible under whatever guise is convenient but hey we make money when they make money so just trust them ok ty bai"?

Do URL shortener services generate "safe" URLs?

URL shortener services, whether web-submission forms or embedded capabilities in blogs and Twitter, are a blessing because they take a long hyperlink and make it smaller and convenient for messaging service with character limits. They are a bane because the shortened URL obfuscates the original URL. Shortened URLs as useful to phishers or spammers as they are to tweeters, bloggers, and email users, because:

• the shortened URL conceals the original, spammy/phishy URL from users (this is the same effect that spammers and phishers hope to achieve by embedding URLs in HTML email)
• users may believe that their shortener service is trustworthy, or
• that all services take measures to prevent a spam or phish URL from being shortened.

The sad reality is that popular URL shortener services come up short when it comes to generating "safe" short URLs.

Safetly Testing Shortened URLs

In March 2011, I ran a greatly simplified set of checks based on the testing reported by StopTheHacker in February 2010. First, I went to SURBL and grabbed the list of services that claimed to use SURBL block lists. Some of these were sign up sites, so I  chose additional URL shortener services from  lists enumerating the most popular services [1, 2] to get to a nice round 11 (a baker's ten?).  I then identified 4 malicious URLs from SURBL, PhishTank, and Spamhaus and tried to shorten these 4 URLs using each of the 11 services.

The results are summarized in the table below. You'll note that some services claim to use SURBL but did not block the SURBL URL. These services may have changed their practice and did not inform the SURBL team or perhaps that they cache block lists rather than perform checks each time they shorten a URL. You'll also note that some services block fresh Spamhaus spam URLs but not suspended domains. It's possible that some services will convert a correctly formed URL without checking if the domain is spammy/phishy or even if the domain name resolves. Since "allowed" is not a desirable result, I didn't pursue this further.

Service	Uses SURBL	SURBL-listed Domain	URL listed on Phishtank	Suspended Domain on Spamhaus DBL	Spamhaus DBL (fresh spam )
bit.ly	YES	allowed	allowed	allowed	allowed
cli.gs	?	blocked	blocked	blocked	blocked
Delivr.com	YES	blocked	allowed	blocked	blocked
goo.gl	NO	allowed	allowed	allowed	allowed
is.gd	YES	blocked	allowed	blocked	blocked
notlong.com	YES	blocked	allowed	blocked	blocked
ow.ly	?	allowed	blocked	allowed	allowed
safe.mn	YES	blocked	blocked	blocked	blocked
snipURL.com	YES	blocked	allowed	allowed	allowed
TinyURL.com	YES	allowed	allowed	allowed	blocked
x.co	NO	allowed	allowed	allowed	allowed

Notes:

allowed indicates that the service did not prevent the shortening of a block listed URL.
allowed indicates that the service allows shortening of a block listed URL but warn
              that the link is possibly abusive.
blocked indicates that the service detected and prohibited shortening of a block listed URL.

If you want to run the tests again, or against your favorite service, here are the URLs I used:

SURBL-listed domain tested: myrxrefillonline.com

URL listed on Phishtank : this was a verified phish at time of testing
http://blizzard.warcraft.info-management-review.net/securityconfirm.html

Suspended domain listed on Spamhaus DBL:pupmypzed.ru
(this domain was on DBL and did not DNS resolve at time of testing)

Spamhaus DBL (fresh spam 3/27/11): rxpillsxad11.ru
(this domain was on DBL and still DNS resolving at time of testing)

Irrespective of whether you test other services or just review the list, I encourage you to go green and use one of the services that pass at least 3 of the four checks I ran.

Some of you may ask, "Should I trust services that allow me to peek at or preview the original URL?" Previewing is a nice feature, and it's offered by SnipURL.com, TinyURL.com, YATUC.com, bit.ly, is.gd, delivr.com, and safe.mn.

Preview at least gives you the same opportunity to stop, look, connect that many email clients offer, but it's not an adequate substitute for checking URLs before shortening.

Mac users listen up! Enable certificate checking

I hope you've all heard of the events leading to certificate authority Comodo incorrectly issuing SSL server certificates for some high profile web sites. This is disconcerting news, compounded by an announcement yesterday from hacker Ich Sun who claims to have breached a second CA.

Please revoke DigiNotar CA trust too!

If there is a silver lining, Comodo's provided details of the incident, including the affected domain names and serial numbers here. These certificates have been revoked, so users and applications that check certificate revocation status will not be affected by the bogus certificates.

My colleague Craig Watkins at Transcend, Inc. points out that not everyone has revocation enabled and provided a detailed explanation of how Mac OS users can enable this defense on a private mailing list. His explanation and testing is well documented and timely, so I invited him to post it here.

What follows is fully attributed to Craig Watkins. I take no credit except for having the good sense to keep company with really competent people and recognizing an opportunity to share this competence with you:-)

Google, Microsoft, and Mozilla have patched their browsers (by 23 March) to add these specific certs to a blacklist that will never be trusted.  So far Apple has not done this, but that's OK if
everything is working fine with certificate status checking.

The complication is that OCSP and CRL checking is disabled by default in Mac OS (except for Extended Validation "EV" certificates). You should turn it on.  While I don't see a
a big risk to most of us from the Comodo issue, in general it is a very good idea to enable this checking.  To do this on Mac OS 10.6:

- Open Applications -> Utilities -> Keychain Access - Under Keychain Access menu, select Preferences... - Select the Certificates tab - Set "Online Certificate Status Protocol (OCSP)" to   "Best Attempt" - Set "Certificate Revocation List (CRL)" to "Best Attempt" - Set "Priority" to "OCSP"

You can now lock the login keychain and close Keychain Access.

This will effect your Safari and Chrome browsers because they use the keychain.  Firefox has its own certificate store, and it should already be configured to use OCSP by default.  For Firefox,

- Under the Firefox menu, select Preferences... - Select the Advanced tab - Select the Encryption sub-tab - Click the (Validation) button - Verify that "Use the Online Certificate Status Protocol" is checked - Verify that "Validate a certificate if it specifies an OCSP server" is selected - Leave "When an OCSP server connection fails, treat the certificate as   invalid" unchecked   (That's consistent with the "Best Attempt" setting in Keychain Access)

To see what it looks like when you visit a site with a revoked certificate, visit
 https://test-sspev.verisign.com:2443/test-SSPEV-revoked-verisign.html

 
 

Your browser should not allow you to go to this site and should report that the certificate is revoked.  You'll notice a stern warning from Firefox, a really stern warning from Chrome, and a quite wimpy warning from Safari.  You should get this warning from Safari and Chrome regardless
of your Keychain Access settings because this site uses one of those EV certificates that I mentioned above.  These certificates have added validation requirements and Mac OS will always attempt an OCSP validation so that your browser can show you that "extra-green SSL bar."

The only downside to this extra checking is possibly a slight delay to perform the request the first time you go to a web site and when the cache expires.  This should be less overhead than downloading a small image, so I'm not worrying about it.

Thanks Craig!