TECHNICAL BACKGROUND:
Netscape Navigator uses random information to generate session encryption keys of either 40 or 128 bits in length. The random information is found through a variety of functions that look into a user's machine for information about how many processes are running, process ID numbers, the current time in microseconds, etc. Previous releases of Netscape Navigator were vulnerable because the size of random input was less than the size of the subsequent keys. This means that instead of searching through all the 2^128 possible keys by brute force, a potential intruder only had to search through a significantly smaller key space by brute force. This was a substantially easier problem to solve because it takes much less compute time and means 40-bit or 128-bit key strength is substantially reduced.
THE SOLUTION:
Netscape Navigator 1.22 (Windows), 1.12 (Macintosh and Unix), 1.12I (localized builds for all 3 platforms) fixes the specific portion of our software where this vulnerability existed. We have significantly increased the amount of random information that cannot be discovered by external sources from approximately 30 bits to approximately 300 bits.
Netscape has greatly expanded the techniques and sources used to generate the random information. The number of unpredictable bits in the RNG makes it no longer the weak link in the chain.
Recommendations to users of Netscape who rely on the security of their transactions:
The 32-bit version now uses the system registry. The purpose of the registry is to incorporate all the configuration information into a registration database file for controlled access.
To manually edit the Preferences, run regedit.exe . Preferences are stored under HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator .
In order to enable this multi-user settings feature in Windows 95, you need to modify your Win95's User Profile option, which is located in the Control Panel Passwords property. Make sure the second option in your User Profile, which allows users to customize preferences and desktop settings, is checked.
For Windows NT, you don't have to do anything. Each user automatically gets their own Netscape Preferences setting.
The default values for the Netscape Preferences will be the same for each user. Initially, all users will be set up to share the same bookmarks, cache, cookie, global history, newsrc and temporary directories. If you do not wish to share these files, change the Preference settings to point to your own private copies of the files. To change the location of cookie and global history files, you need to edit the Registry directly. The other files and directories can be set under the Options Menu - Preferences.
Also, When logging in to your ftp account, Netscape will now automatically go to your home directory; instead of the root directory.
[Network] use Async DNS=noThe default is to use Async DNS, not using it will result in lower performance and can cause problems when multiple simultaneous connections are attempted. You can also set
[Network] Max Connections=1which will prevent problems when not using Async DNS but will also result in much slower performance.
PC-NFS from Sun and Spry's newly updated stack are the only winsocks we know of that require setting the "Async DNS" flag to "no".
On Windows, LVIEW31.EXE (for .gif and .jpg images), MPEGPLAY.EXE (for MPEG movies), and WHAM.EXE (for audio files) are all useful applications. Here are other sites where these applications can be found at : ftp://ftp.cica.indiana.edu, or you can also try ftp://gatekeeper.dec.com/pub/micro/msdos/win3/.
Help | Site Map | How to Get Netscape Products | Advertise With Us | Add Site | Custom Browser Program |
Autos | Business | Computing & Internet | Entertainment | Family | Games | Health | Lifestyles | Local | Netscape | Netscape Open Directory | News | Personal Finance | Real Estate | Research & Learn | Shopping | Small Business | Sports | Travel |
© 1999 Netscape, All Rights Reserved. Legal & Privacy Notices This site powered by Netscape SuiteSpot servers. |