Chrome on iOS fails revoked and pinning tests.
Bad SSL
41–50 of 93 posts
Re: Bad SSL
#42Earlier quoted context omitted.
I think you're right but missing the context: badssl.com was setup as a resource for security engineers who are running tests. It's great for that and it allows the kind of fine-grained testing which anyone who is developing software, configuring firewalls or group policy, etc. would want — i.e. if you do anything which consumes HTTPS, why not take the time to add a step to your CI process which prevents accidental r…
Ah I see It's an interesting concept and service, no doubt about it, but giving the test results as Pass/Fail would be more helpful ;)
I think https://badssl.com/dashboard/ does a good job at that — you could probably do something like what SSL Labs does with a letter grade but I think the Good/Okay/Bad levels is probably the level of nuance you want for a simple “Should I learn more about this?” prod.
What I'd like would be for that to eventually become the default view with an advanced tab for people who want to drill down into the full list of everything available.
Re: Bad SSL
#43Chrome on iOS fails revoked and pinning tests.
So does Safari on iOS.
I'd say it also fails the others, because simply pressing 'continue' makes the warning dissapear without any visual indication that the connection is insecure.
Re: Bad SSL
#44Earlier quoted context omitted.
The site has no such obligation. The site is for a very specific target audience: people who write web clients/web browsers. So the site isn't created for you, and it isn't meant for general consumption, and it doesn't have to explain anything. It's a tool for web client developers, like it says in the github README. Which is one click away. If the developers of this tool posted this as a SHOW HN, then yes, you'd hav…
Actually I am a developer and this is useful to my work so it is targeted exactly at someone like me. It would still help to have a description without going to github. Just some /constructive/ feedback...
[deleted]
Re: Bad SSL
#45I created a complementary resource, https://badtls.io to allow for automated testing of TLS client libraries. It uses its own self-gendered CA root to allow for generating certificates that exhibit different edge case conditions.
A few practical differences are that badtls.io is designed to be easy to run locally and having simple Python scripts to generate new keys and certs.
For my TLS libraries I utilize both badssl.com and badtls.io to provide more diverse coverage.
Re: Bad SSL
#46Earlier quoted context omitted.
The site has no such obligation. The site is for a very specific target audience: people who write web clients/web browsers. So the site isn't created for you, and it isn't meant for general consumption, and it doesn't have to explain anything. It's a tool for web client developers, like it says in the github README. Which is one click away. If the developers of this tool posted this as a SHOW HN, then yes, you'd hav…
Actually I am a developer and this is useful to my work so it is targeted exactly at someone like me. It would still help to have a description without going to github. Just some /constructive/ feedback...
Sure, it would help, in that it would have saved you a single click.
If you had submitted the link to HN with a descriptive title, then there wouldn't have been any confusion here either. So you're complaining about the site not saying what it does (even though it says so right in the README) while at the same time submitting the link to HN with a title that doesn't say what the link is about.
As some /constructive/ feedback, do you appreciate the irony?
Re: Bad SSL
#47No-subject is surprising to me. Why would Chrome allow that? Doesn't that open it up for MITM?
The certificate at no-subject.badssl.com has an empty subject field, but it still contains the subject domain name in the Subject Alternative Names (SAN) extension.
Using the original X.509 subject field for the domain name has been deprecated for some time, and modern TLS clients look at the SAN extension instead.
Re: Bad SSL
#48I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…
I guess I'm smarter than half the people on this website because half the comments are complaining about how confusing this is and I figured it out in about 2 seconds.
Re: Bad SSL
#49If this is meant for general technical consumption, it's sorely lacking in usability. After several seconds, I guessed that it might be referring to something about my browser. Some of the colours seem to indicate badness. Clicking on things provides no additional information, but then makes me wonder if it's meant to be an example of a bad webpage and there's nothing wrong with my browser. Another failure of minimal…
You have the wrong expectations. You're looking at what amounts to an enumeration of test cases for regression suites to run against.
Think of it as expecting to see gas gauges and speedometers (and no grease) on the oil pan of your car.
Re: Bad SSL
#50I'm surprised to see so many negative comments. It's a super straightforward UI, you click on stuff to see how your browser treats that ssl (mis)configuration. This is a great resource, thanks for posting.