Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How's my SSL?

howsmyssl.com

Post reply on HN
Print view View original

71–80 of 91 posts

Re: How's my SSL?

#71

Post by davidjgraph »

DiabloD3 wrote: post #69
davidjgraph wrote: post #65

Site doesn't load on IE 6. I wonder if you've configured the SSL certs with SNI? Would have been nice to see the page turn red, but I guess I know the answer without having to run it... Edit: It's not an SNI issue, IE 8 on XP can load the site.

MSIE6 does not support new enough SSL to be considered secure. I wouldn't be surprised if a lot of sites no longer work with MSIE 6 over the next two years as sites transition to turning RC4 and SHA1 off.

We all know this. My point is, the site gives some indication as to how effective any particular browser's SSL is, yet the site doesn't function for the worst offenders.

Re: How's my SSL?

#72

Post by jhgg »

How exactly does this work? Is it sniffing the user-agent and comparing it against known values, or does it actually inspect the connection?

Re: How's my SSL?

#73

Post by gcp »

ivanr wrote: post #70
gcp wrote: post #16

Earlier quoted context omitted.

You can "fix" the result on this webpage by flipping some settings in Firefox, but it will cause some websites to no longer work (guess why they aren't defaulted?). Newer versions (27 and up) will detect this and work around appropriately. They also have those settings by default. If you absolutely require this website to tell you you're safe so you get a warm fuzzy feeling and can sleep at night, update to Firefox B…

Correct. Firefox and all other modern browsers use the so-called 1/n-1 split technique to mitigate the BEAST attack. It's actually possible to test if the mitigation is present; it's just that this site has not implemented it.

The documentation of the site actually just changed to imply they test for record splitting (it said they didn't before). However, testing with Firefox 26 shows it's still incorrectly flagged.

Re: How's my SSL?

#74

Post by 72deluxe »

outside1234 wrote: post #29
josho wrote: post #20

Earlier quoted context omitted.

Thanks for that. I'm surprised to find that Apple's OSX Server (Mavericks) ships without TLS 1.1 or 1.2 support. Are these not widely deployed? Or no sense of urgency since 1.0 isn't broken.

Apple still ships a server? Didn't know that.

Server software as an add on downloadable from the App Store on the Mac, not a physical server like XServe. They recommend a Mac Mini with two hard disks installed as a SOHO server but obviously aren't catering for large neworks - no hot-swappable drives or fancy RAID for example (unless you use an external Thunderbolt caddy). They're leaving that market to Windows AD and Linux (mostly Windows AD I suspect). Oddly, the server software on the Mac gets less and less features each release since Snow Leopard apparently. I think Ars Technica has a review of the server software, and is pretty in-depth.

Re: How's my SSL?

#76

Post by ivanr »

gcp wrote: post #73
ivanr wrote: post #70

Earlier quoted context omitted.

Correct. Firefox and all other modern browsers use the so-called 1/n-1 split technique to mitigate the BEAST attack. It's actually possible to test if the mitigation is present; it's just that this site has not implemented it.

The documentation of the site actually just changed to imply they test for record splitting (it said they didn't before). However, testing with Firefox 26 shows it's still incorrectly flagged.

There's a commit from about 2 hours ago that enables 1/n-1 detection. So perhaps that's what they are running now. But it does not seem to be implemented correctly: when I access the site with a Java client (which does implement the split), the site says that it's vulnerable.

Re: How's my SSL?

#77

Post by hsivonen »

jjjeffrey wrote: post #28
trentmb wrote: post #4

Earlier quoted context omitted.

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

Say I change security.tls.version.max to 3, which changes it's status from 'default' to 'user set'. In the future, if the default for security.tls.version.max is changed to, say, 4, would the fact that my setting has the 'user set' status prevent it from incrementing to the better default? I'm not proposing that this is a risk or that Firefox behaves this way---I have no idea. Does anyone else know?

The (non-about:config) UI for these settings was removed for a reason. Even though it makes sense for these to be configurable for testing, end users are more likely to break their browser (make it less secure or make it incompatible with real sites they need to use) by tweaking these settings.

Firefox developers have had to reset these settings in the past in order to save users from self-inflicted insecurity.

Without an explicit effort by Firefox developers to reset these prefs, the prefs won't automatically reset to make sense in the future if the value space of the prefs grows. There is no guarantee of what explicit effort might be taken to deal with non-default values of these prefs in the future.

In my opinion, anyone who wants https://www.howsmyssl.com/ to tell them they are probably okay today should install Firefox Beta (or Aurora or Nightly) instead of manually changing these settings.

(Disclosure: I'm a Gecko developer but I don't work on TLS. Disclaimer: The above is my personal understanding and opinion, not any sort of official statement.)

Re: How's my SSL?

#78

Post by agl »

gcp wrote: post #62
agl wrote: post #25

Earlier quoted context omitted.

Chrome on Android ships with its own copy of OpenSSL and so can do things different than Android Browser.

It's not using NSS? (I was going to correct you but then I remembered who you are...)

Chrome uses NSS everywhere except on Android, where it's OpenSSL.

Re: How's my SSL?

#79

Post by Tepix »

RRRA wrote: post #22

RC4 and MD5 are secure now?!

I'm surprised that RC4 counts as GOOD, too. I thought it's considered broken. Jakob Appelbaum said we should assume it can be cracked in realtime.

Re: How's my SSL?

#80

Post by slashdotaccount »

Will it make my client more unique (so identifiable) for a third-party passive advisory (who can sniff traffic) if I fine-tune my browser's settings for example to support only TLS 1.2 and by removing all the RC4 encryption methods?
Post reply on HN