11–20 of 91 posts
Excellent! (I mean the site. Not so crazy that FF 26 under OSX 10.9.1 is listed as BAD, but I understand and accept the reasoning.) Hopefully this will spur the various vendors to abandon old, broken protocols and ciphers.
It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false
Earlier quoted context omitted.
It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false
Why is that not set by default?
Some info on how to correct this on common browsers where it can be corrected (I use FF 26; marked bad, and comments in this thread say that some of the problems can be fixed) would be a great improvement.
If you absolutely require this website to tell you you're safe so you get a warm fuzzy feeling and can sleep at night, update to Firefox Beta. Don't just randomly go and change the settings, then wonder 2 weeks later why your banking website no longer works.
Also note that the site marks Firefox as Bad with TLS 1.0 because it can't verify for sure whether you have BEAST mitigation. But Firefox has BEAST mitigation.
> Bad: Your client is using TLS 1.0, which is very old, possibly susceptible to the BEAST attack, and doesn't have the best cipher suites available either.
Interestingly I get "Probably good" using the Chrome browser on the same phone.
Earlier quoted context omitted.
It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false
Are there any downsides of changing these settings?
And for testing your servers: https://www.ssllabs.com/ssltest/analyze.html
I'm surprised to find that Apple's OSX Server (Mavericks) ships without TLS 1.1 or 1.2 support.
Are these not widely deployed? Or no sense of urgency since 1.0 isn't broken.