Removing SSLv3 in Chrome
groups.google.com
Removing SSLv3 in Chrome
1–10 of 36 posts
Re: Removing SSLv3 in Chrome
#2Huge props to the Chromium team for doing this; it's an excellent precedent.
SSLv3 is broken, and the only reason it's been so well-supported is that the browsers were unwilling to break web servers; the operators of those servers can't be counted on to fix them, and users direct their ire at the browser vendors. But apparently there's a red line across which the browsers won't make up for broken server configurations, and POODLE crossed it.
Re: Removing SSLv3 in Chrome
#3Huge props to the Chromium team for doing this; it's an excellent precedent. SSLv3 is broken, and the only reason it's been so well-supported is that the browsers were unwilling to break web servers; the operators of those servers can't be counted on to fix them, and users direct their ire at the browser vendors. But apparently there's a red line across which the browsers won't make up for broken server configuration…
It also helps that POODLE is in the news too.
Re: Removing SSLv3 in Chrome
#4Huge props to the Chromium team for doing this; it's an excellent precedent. SSLv3 is broken, and the only reason it's been so well-supported is that the browsers were unwilling to break web servers; the operators of those servers can't be counted on to fix them, and users direct their ire at the browser vendors. But apparently there's a red line across which the browsers won't make up for broken server configuration…
Just to add, Firefox announced two weeks ago that SSLv3 would be disabled by default in Firefox v34[1], around late November.
[1] https://blog.mozilla.org/security/2014/10/14/the-poodle-atta...
Re: Removing SSLv3 in Chrome
#5Huge props to the Chromium team for doing this; it's an excellent precedent. SSLv3 is broken, and the only reason it's been so well-supported is that the browsers were unwilling to break web servers; the operators of those servers can't be counted on to fix them, and users direct their ire at the browser vendors. But apparently there's a red line across which the browsers won't make up for broken server configuration…
I will say huge props when they actually remove it. Not when they just remove the fallback.
Re: Removing SSLv3 in Chrome
#6Microsoft is planning the same: http://azure.microsoft.com/blog/2014/10/29/protecting-agains...
Re: Removing SSLv3 in Chrome
#7Microsoft is planning the same: http://azure.microsoft.com/blog/2014/10/29/protecting-agains...
This link is not specific to what versions of IE this affects. Is it for all their supported versions 9 to 11?
Re: Removing SSLv3 in Chrome
#8Why not go further?
I'd be all for very disturbing warnings for any version of TLS before 1.2, and somewhat scary warnings for low-security or non-PFS operational modes.
Basically, enough so that in a big company corporate would ring up the IT department to "fix the ssl site for giving an error", but not enough so that everyone clicks through the "ignorable warning".
Re: Removing SSLv3 in Chrome
#9Why not go further? I'd be all for very disturbing warnings for any version of TLS before 1.2, and somewhat scary warnings for low-security or non-PFS operational modes. Basically, enough so that in a big company corporate would ring up the IT department to "fix the ssl site for giving an error", but not enough so that everyone clicks through the "ignorable warning".
It wouldn't work. Users would see "very disturbing warnings" so often that the warnings would quickly stop disturbing them. Everyone --- everyone --- would blame the browsers, the way 3/4 of HN blamed Firefox when they enabled the fascist warning for self-signed certs (incidentally: a much more severe security problem than POODLE!).
If you want to think about "further", you want to suggest that Chromium disable support for TLS 1.1 and below. Nobody can ignore sites that break because they don't use the most secure variant of TLS. But that's obviously not going to happen.
Re: Removing SSLv3 in Chrome
#10Why not go further? I'd be all for very disturbing warnings for any version of TLS before 1.2, and somewhat scary warnings for low-security or non-PFS operational modes. Basically, enough so that in a big company corporate would ring up the IT department to "fix the ssl site for giving an error", but not enough so that everyone clicks through the "ignorable warning".
It wouldn't work. Users would see "very disturbing warnings" so often that the warnings would quickly stop disturbing them. Everyone --- everyone --- would blame the browsers, the way 3/4 of HN blamed Firefox when they enabled the fascist warning for self-signed certs (incidentally: a much more severe security problem than POODLE!). If you want to think about "further", you want to suggest that Chromium disable suppo…
Yea, it would be likely a couple of years at least before we can disable TLS 1.0.