Shouldn't spoofed favicon link to http instead of https?
Bad SSL
81–90 of 93 posts
Re: Bad SSL
#82Earlier quoted context omitted.
Although the color-coding is odd; red doesn't mean insecure or even "dubious", even though it does sometimes... So using the site even for testing TLS clients seems a little non-obvious. At least if the idea was that your client should accept green and reject red connections, the site has definitely failed. If the idea was just to let you see what happens, then why the color coding?
Can you tell me which `red` is not insecure? (or not obsolete)
https://mozilla-old.badssl.com/ negotiates to TLS1.2 ECDHE RSA AES128 GCM SHA256 for me (FF54) which is fine.
There may well be obsolete stuff that server does support; but as negotiated, that's pretty much as good as it gets. It even has the new downgrade-prevention extensions on, so support for the old stuff shouldn't be a problem even if your client accepts it (which it need not).
Re: Bad SSL
#83An incredibly useful resource, well maintained by some of the best people in the PKI space, recently quoted by US-CERT [1] and so quick to use that I try it before starting to use any browser. A year ago it made me find out that the most popular iOS Tor browser doesn't check certificates at all. [2] (Use OnionBrowser instead.) [1] https://www.us-cert.gov/ncas/alerts/TA17-075A [2] https://twitter.com/FiloSottile/statu…
amazing, how does one get to know certificate security when its scattered over a gazillion of RFC's ?
Re: Bad SSL
#84If this is meant for general technical consumption, it's sorely lacking in usability. After several seconds, I guessed that it might be referring to something about my browser. Some of the colours seem to indicate badness. Clicking on things provides no additional information, but then makes me wonder if it's meant to be an example of a bad webpage and there's nothing wrong with my browser. Another failure of minimal…
I found the website pretty obvious after clicking one of the links and landing on a subdomain.
You people consistently make me feel like a real wonder boy.
Re: Bad SSL
#85Earlier quoted context omitted.
That's mostly correct, except for some definitions of "should". Chrome connects to the Mozilla "Old" config, which is fine. The "Old" config does not mean "only old/bad ciphersuites", it means: "support old/bad clients". Chrome negotiates AES128GCM with ECDHE on my desktop, so it is rightfully pretty happy. Meanwhile, while 2048 bit FFDH is considered safe, Chrome refuses to connect to it, for reasons that I've elabo…
Given what you say - what's the point of this website? After all, a safe client should connect to green things (but might not support everything, fine), and... should also connect to many red things (if they're actually safe). What's the point?
It helps you figure out what a client actually does, for differentiating browsers, or eg making sure that CLI tool verifies certs.
Re: Bad SSL
#86Really don't understand the people downvoting in this thread. Apparently a certain percentage of the population believes that if they don't understand the function of an artifact in the world, the maker of said artifact has failed. It isn't quite projection; seems like more of some wildly misguided consumer-is-king impulse. Browsing academic libraries must be hell.
> if they don't understand the function of an artifact in the world, the maker of said artifact has failed.
Biggest Mistakes in Web Design 1995-2015
#2 A Man From Mars Can't Figure Out What Your Website Is
About In Less Than Four Seconds.It seems badssl caters to a bunch of insiders who knows about its function, a quick description of what is its purpose and how to use it would make it quite useful to a larger public.
Re: Bad SSL
#87I'm surprised to see so many negative comments. It's a super straightforward UI, you click on stuff to see how your browser treats that ssl (mis)configuration. This is a great resource, thanks for posting.
You should not be surprised. UI is not UX and UX here is terrible for those who can't figure out what the purpose of badssl.com is.
Simply replacing the page title repeating the domain name by an explicit title along the lines of what's used on ssl labs client test: "test SSL/TLS Capabilities of Your Browser". https://www.ssllabs.com/ssltest/viewMyClient.html
I
Re: Bad SSL
#88I created a complementary resource, https://badtls.io to allow for automated testing of TLS client libraries. It uses its own self-gendered CA root to allow for generating certificates that exhibit different edge case conditions. A few practical differences are that badtls.io is designed to be easy to run locally and having simple Python scripts to generate new keys and certs. For my TLS libraries I utilize both bads…
Always wanted to see what a self-gendered CA root would be like ;P
Re: Bad SSL
#89Earlier quoted context omitted.
It should at LEAST say it is targeting the browser for the tests, not someone's ssl site. I had no idea it was testing my phone until I went to the other test site link in the footer. I can't believe you go to such length defending the "UX" when it isn't even obvious what the test is for. Seriously.
The site has no such obligation. The site is for a very specific target audience: people who write web clients/web browsers. So the site isn't created for you, and it isn't meant for general consumption, and it doesn't have to explain anything. It's a tool for web client developers, like it says in the github README. Which is one click away. If the developers of this tool posted this as a SHOW HN, then yes, you'd hav…
I went to read the readme and it doesn't say anywhere that it is a tool for web client developers.
Anyways this kind of info should not be hidden a click away in a github readme, it belongs in the actual web page.
Re: Bad SSL
#90I had no idea what was the purpose of this website until I found some explanation in the comments.
Adding offense to injury it actually shows unhelpful info if you put your cursor on the Badssl title on top of the page.
Allow to suggest a little modification here, replace the following:
badssl.com
with
badssl.com - manual testing of security UI in web clients