Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How's my SSL?

howsmyssl.com

Post reply on HN
Print view View original

41–50 of 91 posts

Re: How's my SSL?

#41

Post by agwa »

fexl wrote: post #32

Does anyone know how to disable TLS 1.0 in Firefox 26.0 (on Linux)? I found this article: http://www.spotht.com/2010/06/how-to-enabledisable-ssl-30-an... However, the Options in my browser do not include a tab called "Encryption", as the article discusses.

Quite a few servers (for example, any server using the version of OpenSSL in Debian Squeeze) do not support anything newer than TLS 1.0, so you'll get quite a bit of breakage if you disable it.

TLS 1.0 in Firefox 26.0 should be secure; it implements 1/n-1 record splitting, so it's safe against BEAST even though this website reports otherwise.

Re: How's my SSL?

#42

Post by gcb0 »

agwa wrote: post #41
fexl wrote: post #32

Does anyone know how to disable TLS 1.0 in Firefox 26.0 (on Linux)? I found this article: http://www.spotht.com/2010/06/how-to-enabledisable-ssl-30-an... However, the Options in my browser do not include a tab called "Encryption", as the article discusses.

Quite a few servers (for example, any server using the version of OpenSSL in Debian Squeeze) do not support anything newer than TLS 1.0, so you'll get quite a bit of breakage if you disable it. TLS 1.0 in Firefox 26.0 should be secure; it implements 1/n-1 record splitting, so it's safe against BEAST even though this website reports otherwise.

Hear this. This site is mostly FUD.

http://security.stackexchange.com/questions/32817/why-dont-m...

Re: How's my SSL?

#43

Post by cvburgess »

outside1234 wrote: post #29
josho wrote: post #20

Earlier quoted context omitted.

Thanks for that. I'm surprised to find that Apple's OSX Server (Mavericks) ships without TLS 1.1 or 1.2 support. Are these not widely deployed? Or no sense of urgency since 1.0 isn't broken.

Apple still ships a server? Didn't know that.

https://www.apple.com/osx/server/

Re: How's my SSL?

#44

Post by DiabloD3 »

josho wrote: post #20
mathrawka wrote: post #12

And for testing your servers: https://www.ssllabs.com/ssltest/analyze.html

Thanks for that. I'm surprised to find that Apple's OSX Server (Mavericks) ships without TLS 1.1 or 1.2 support. Are these not widely deployed? Or no sense of urgency since 1.0 isn't broken.

IIRC they just ship Apache, so just follow the normal instructions for enabling perfect forward secrecy on Apache.

Re: How's my SSL?

#45

Post by agwa »

gcb0 wrote: post #42
agwa wrote: post #41

Earlier quoted context omitted.

Quite a few servers (for example, any server using the version of OpenSSL in Debian Squeeze) do not support anything newer than TLS 1.0, so you'll get quite a bit of breakage if you disable it. TLS 1.0 in Firefox 26.0 should be secure; it implements 1/n-1 record splitting, so it's safe against BEAST even though this website reports otherwise.

Hear this. This site is mostly FUD. http://security.stackexchange.com/questions/32817/why-dont-m...

The site is mostly OK. It just needs to properly test for the BEAST vulnerability (ideally it would check for a 1 byte record, but a whitelist of user agents known to implement 1/n-1 record splitting would suffice in the interim), instead of assuming anyone with TLSv1.0 is vulnerable. And it should rate TLSv1.0 (with record splitting) as "Improvable" rather than "Bad".

But yes, being faced with a huge "Your SSL client is Bad" banner when visiting from up-to-date Firefox is FUD.

Re: How's my SSL?

#46

Post by logn »

hundchenkatze wrote: post #40
fexl wrote: post #32

Does anyone know how to disable TLS 1.0 in Firefox 26.0 (on Linux)? I found this article: http://www.spotht.com/2010/06/how-to-enabledisable-ssl-30-an... However, the Options in my browser do not include a tab called "Encryption", as the article discusses.

change security.tls.version.min to 2 in about:config 0 = SSLv3 1 = TLSv1.0 2 = TLSv1.1 3 = TLSv1.2 For reference: http://kb.mozillazine.org/Security.tls.version.*

And change security.tls.version.max to 3 (to enable TLS 1.2).

Also about:config will let you disable security.ssl3.rsa_fips_des_ede3_sha

Making those changes gives me "Probably Okay" rating on howsmyssl.com

Re: How's my SSL?

#47

Post by erichurkman »

jjjeffrey wrote: post #28
trentmb wrote: post #4

Earlier quoted context omitted.

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

Say I change security.tls.version.max to 3, which changes it's status from 'default' to 'user set'. In the future, if the default for security.tls.version.max is changed to, say, 4, would the fact that my setting has the 'user set' status prevent it from incrementing to the better default? I'm not proposing that this is a risk or that Firefox behaves this way---I have no idea. Does anyone else know?

Often with settings like this, they will flip the preference name to something like `security.tls.max_version` or something so user-set and extension-set overrides are invalidated. They've done this with other common, significant settings that users often overrode.

Re: How's my SSL?

#48

Post by pyroMax »

MWil wrote: post #39
djcapelis wrote: post #33

Earlier quoted context omitted.

Some websites may not work over TLS if they don't support it.

yeah I found that out already. So far so good with most of my regular sites with min: 2, max:3

Try: https://apple.com without the www part.

Update: https://www.microsoft.com also breaks.

Post reply on HN