Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How's my SSL?

howsmyssl.com

Post reply on HN
Print view View original

21–30 of 91 posts

Re: How's my SSL?

#21

Post by handsomeransoms »

mathrawka wrote: post #9
trentmb wrote: post #4

Earlier quoted context omitted.

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

Why is that not set by default?

TLS 1.2 will be enabled by default in the next release, Firefox 27, which will be released the week of February 4th. So, in less than 4 weeks, Firefox release will be "good".

Re: How's my SSL?

#24

Post by huxley »

stuartd wrote: post #23

Safari 6.1.1 is BAD because it allows TLS 1.0 and there seems to be no way to fix it..

On a positive note, Safari 7.0.1 does better, it seems to only lack session ticket support (rating is "Your SSL client is Improvable")

Re: How's my SSL?

#25

Post by agl »

poizan42 wrote: post #18

On the built in browser in CyanogenMod 10.1.3: > Bad: Your client is using TLS 1.0, which is very old, possibly susceptible to the BEAST attack, and doesn't have the best cipher suites available either. Interestingly I get "Probably good" using the Chrome browser on the same phone.

Chrome on Android ships with its own copy of OpenSSL and so can do things different than Android Browser.

Re: How's my SSL?

#26

Post by MWil »

trentmb wrote: post #4
PeterWhittaker wrote: post #2

Excellent! (I mean the site. Not so crazy that FF 26 under OSX 10.9.1 is listed as BAD, but I understand and accept the reasoning.) Hopefully this will spur the various vendors to abandon old, broken protocols and ciphers.

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

anything wrong with setting both the min AND max to 3?

Re: How's my SSL?

#27

Post by breser »

PeterWhittaker wrote: post #2

Excellent! (I mean the site. Not so crazy that FF 26 under OSX 10.9.1 is listed as BAD, but I understand and accept the reasoning.) Hopefully this will spur the various vendors to abandon old, broken protocols and ciphers.

For what it's worth FF 27 from the beta channel on OS X 10.9.1 is passing.

Re: How's my SSL?

#28

Post by jjjeffrey »

trentmb wrote: post #4
PeterWhittaker wrote: post #2

Excellent! (I mean the site. Not so crazy that FF 26 under OSX 10.9.1 is listed as BAD, but I understand and accept the reasoning.) Hopefully this will spur the various vendors to abandon old, broken protocols and ciphers.

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

Say I change security.tls.version.max to 3, which changes it's status from 'default' to 'user set'. In the future, if the default for security.tls.version.max is changed to, say, 4, would the fact that my setting has the 'user set' status prevent it from incrementing to the better default?

I'm not proposing that this is a risk or that Firefox behaves this way---I have no idea. Does anyone else know?

Re: How's my SSL?

#29

Post by outside1234 »

josho wrote: post #20
mathrawka wrote: post #12

And for testing your servers: https://www.ssllabs.com/ssltest/analyze.html

Thanks for that. I'm surprised to find that Apple's OSX Server (Mavericks) ships without TLS 1.1 or 1.2 support. Are these not widely deployed? Or no sense of urgency since 1.0 isn't broken.

Apple still ships a server? Didn't know that.
Post reply on HN