Given the interest in the topic, I summarize the state of encryption-protected access on 5 political party websites.
Of these, only the Partito Democratico website has securely encrypted access. Acceptable with reservations.
Movimento 5 Stelle has an excellent system, Rousseau, but not everything is secure. Fratelli d’Italia, Forza Italia and Lega Nord: totally absent.
One political thought of my own (take it constructively): I expected more care from Movimento 5 Stelle, considering that the network is its battle horse.
Imagine for example that a user visits those websites from a public access point (public wifi, hotel, airport etc.). An attacker could:
- intercept credentials in the clear (including passwords in the clear, often reused).
- redirect the request (by altering the HTML form) to malicious websites.
- alter the response, inserting JavaScript that acts as a keylogger so as to intercept every possible future interaction as well.
These EXAMPLES of potential attacks apply to everyone, including the PD, since it has not enforced the secure version on credential forms.
Most browser vendors have long-term plans to abolish cleartext connections (e.g. Firefox), and the first imminent steps are implementing security warnings (e.g. FireFox, Chrome).
The public Chrome used by ordinary people is version 55. The version that will notify that the websites mentioned above are insecure will be 56. It is really very imminent, imho.
Movimento 5 Stelle / Beppe Grillo
Rousseau https://rousseau.movimento5stelle.it is excellently configured.
Certificate hash algorithm sha256 ok, ssl-labs: A+ rating very high (the maximum, fairly rare),
excellent use of HSTS which guarantees upfront that the site is entirely under encryption. Web-server version hidden.
A serious flaw: registration points to another machine, poorly configured:
- It reports an old Apache/2.2.15, which has several known vulnerabilities.
Some vulnerabilities may be closed (for example like Debian packages in the stable repo on LTS distros); I have not investigated individual vulnerabilities.
Penetration testing is more demanding than this spare-time research of mine. - It returns a certificate that has been expired for several days.
- Wrong common-name (www.beppegrillo.it), which leads to a non-existent web page (404).
- Hash algorithm sha1, bad.
- Vulnerable to POODLE and weak ciphers.
- Incredible choice. Usually it is acceptable to have a cleartext site with the authentication section (login/register) under encryption. But having Rousseau protected and registration in the clear is the exact opposite.
Registration is therefore necessarily in the clear, because using a poor-rated access ssl-labs: T is equivalent to not using it.
I see excellent premises; roughly speaking, it would be enough for the Rousseau team to also take charge of the other misconfigured machine.
Partito Democratico
Good, not excellent.
Encrypted access https://www.partitodemocratico.it/ is OK.
The flaw is that the cleartext version works; it could redirect directly to the encrypted version, or better still implement HSTS like Rousseau.
It is an important flaw because the login version also works from non-encrypted access.
Objectively, if an access is insecure and the secure version exists, isn’t it possible to meet halfway with users who do not know the difference or do not even know they can choose?
Small flaw: https://partitodemocratico.it returns ERR_BAD_SSL_CLIENT_AUTH_CERT. It seems only the third-level “www.” is misconfigured.
SSL certificate ok for sha256. ssl-labs: B can be improved; some accesses with weak ciphers should be closed. Rousseau is better configured.
They seem to use Apache 2.2.22 on FreeBSD. I do not know FreeBSD well enough.
Curiosity: From the website, clicking Accedi leads to a URL of 3228 characters/bytes. All essential, of course. (ironic).
Fratelli d’Italia
On http://www.fratelli-italia.it encrypted access practically does not exist.
Membership and login only in the clear.
The encrypted version of membership shows a 503 Service Unavailable, with a self-signed certificate that does not even match the common-name.
ssl-labs: F. Vulnerable to the POODLE attack, weak ciphers, etc.
At least they hide which web-server software they use.
Forza Italia
http://www.forzaitalia.it is cleartext only; encrypted access for the main site does not respond.
The login is in the clear.
Encrypted access for login returns page not found (HTTP 404).
Self-signed SSL certificate, expired 3 years ago. 1024 bits. Practically as if it were not there.
ssl-labs: F All weak. Two different vulnerabilities, POODLE and CVE-2016-2107.
Practically encrypted access does not exist.
Apache/2.2.25 Amazon.
Lega Nord
http://www.leganord.org/ all in the clear. Encrypted access does not exist.
Apache 2.4.10 on Fedora.