Regularly used to test client configurations and also as a training aid when teaching users about web security.
Bad SSL
51–60 of 93 posts
Re: Bad SSL
#52I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…
Is this some kind of comedy bit you're doing? You clearly understand the gist of what's going on and instead of asking for minor clarifications you're being unnecessarily facetious.
The single point of contention seems to be whether this site is showing you what your browser claims to support, or whether it's showing you its own opinions of which configurations are safe to use. I believe it's the latter (but you're right, some more clarification on the github page or something would be useful).
And look, you learned something already - chrome thinks dh2048 is unsafe while this site thinks it's fine. If you now want to go learn more about why that is, great. It would be worse if you saw something in the opposite direction - if this site had a configuration marked as red and chrome rendered it as secure, that would mean you're vulnerable to attacks exploiting that configuration.
Re: Bad SSL
#53Earlier quoted context omitted.
From the github readme: > badssl.com is meant for manual testing of security UI in web clients. And my understanding is that green things are things that are good (security wise), red is bad. You'll have to test yourself if they work with your browser.
No, that's what it looks like, though Open the dashboard and it's more 'verbose'. Red means it didn't connect to that site as it shouldn't in certain situations
Grandparent is still correct. The dashboard connects to stuff, but on the main linked site, red still means bad and green still means good.
For example, in current Chrome, Mozilla "Old" TLS config is red, but Chrome connects fine.
Re: Bad SSL
#54I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…
To clarify: this doesn't show what's supported and what's not, that's for you to find out by clicking things. It shows things in green that are generally considered secure. For example, 2048-bit finite-field ephemeral Diffie-Hellman (that's dh2048.badssl.com) is generally still considered secure, but Chrome doesn't allow it, so that's why you get that error even though the website shows it as green.
Chrome does so for tangentially related, mostly-fine reasons. Generally dh2048 doesn't really exist on much of the Internet: because clients that don't do ECHDE (only DHE) are also generally limited to 1024-bit FFDH. That's not as good (not totally busted, but not great either). Anything that does 2048 bit FFDH probably also does ECDHE, and ECDHE is much better from a performance perspective and marginally better from a security perspective.
The best classical attacks put P-256 at about 128 bits of security, and 2048 bit FF at about 112. Neither is problematic at present. FFDH has some other problems: because the other peer communicates the field over which you're going to work, a poorly configured or malicious peer could pick a bad field or a small subgroup. (That's a little esoteric, but since there's no good reason to keep it around anyway....)
Re: Bad SSL
#55In case you're wondering how you might use this: BadSSL is really convenient for checking clients. Is that weird version of Curl in that PHP webapp totally busted? Answer: probably yes -- although you can use this to find out how it's busted specifically in the context of TLS.
If you have a modern browser, whatever it does is probably fine. Also, consider using Chrome. (Yes, I know about the battery life issues.)
(Curl-from-PHP can be bad for non-TLS reasons! It's a likely SSRF vector, and it often does things like TFTP and Gopher so it will helpfully let you speak all sorts of protocols.)
Re: Bad SSL
#56I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…
Took me a little while to understand as well but it's supposed to test your client. You browser should be able to display the green links without errors and should refuse to navigate to the red ones since they are insecure for one reason or an other (weak algorithms, broken SSL etc...)
That's mostly correct, except for some definitions of "should". Chrome connects to the Mozilla "Old" config, which is fine. The "Old" config does not mean "only old/bad ciphersuites", it means: "support old/bad clients". Chrome negotiates AES128GCM with ECDHE on my desktop, so it is rightfully pretty happy.
Meanwhile, while 2048 bit FFDH is considered safe, Chrome refuses to connect to it, for reasons that I've elaborated on elsewhere in the thread.
Re: Bad SSL
#57I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…
I think it's showing examples of SSL gone wrong, so you know what you're looking at if it happens on your site.
If you're interested in figuring out what's wrong with TLS configuration on your site, SSLLabs is a much more useful tool. This is for checking if an SSL client (like your browser, but also e.g. a command line tool) is doing something bad.
Re: Bad SSL
#58I'm surprised to see so many negative comments. It's a super straightforward UI, you click on stuff to see how your browser treats that ssl (mis)configuration. This is a great resource, thanks for posting.
The UI is straightforward, true. Very simple. That's not the same as good. The comments here indicate that a great many people simply don't understand what they're looking at. That's bad. A straightforward, simple UI is useless if people don't understand what it's telling them.
Re: Bad SSL
#59If this is meant for general technical consumption, it's sorely lacking in usability. After several seconds, I guessed that it might be referring to something about my browser. Some of the colours seem to indicate badness. Clicking on things provides no additional information, but then makes me wonder if it's meant to be an example of a bad webpage and there's nothing wrong with my browser. Another failure of minimal…
You have the wrong expectations. You're looking at what amounts to an enumeration of test cases for regression suites to run against. Think of it as expecting to see gas gauges and speedometers (and no grease) on the oil pan of your car.
[deleted]
Re: Bad SSL
#60I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…
To clarify: this doesn't show what's supported and what's not, that's for you to find out by clicking things. It shows things in green that are generally considered secure. For example, 2048-bit finite-field ephemeral Diffie-Hellman (that's dh2048.badssl.com) is generally still considered secure, but Chrome doesn't allow it, so that's why you get that error even though the website shows it as green. Chrome does so fo…
Yea, it really should have a short description at the top. That alone would make the UI instantly more useful.