Somewhat related: https://www.howsmyssl.com/
Bad SSL
21–30 of 93 posts
Re: Bad SSL
#22I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL?
Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders that and it probably shouldn't.
dh2048 is green let's click that. "dh2048.badssl.com uses an unsupported protocol. ERR_SSL_OBSOLETE_CIPHER"
Alright, I give up. I have no idea what I'm looking at.
Edited to add: If this site is reporting issues with my browser, why does it seem to say that Chrome supports dh2048 (this item is green on the page) but then following the link the browser complains that it's unsupported? Either the point of this site is not obvious, or it cannot be trusted to know the right things about my browser.
Re: Bad SSL
#23I misclicked and realised how many times this has been posted
Re: Bad SSL
#24If this is meant for general technical consumption, it's sorely lacking in usability. After several seconds, I guessed that it might be referring to something about my browser. Some of the colours seem to indicate badness. Clicking on things provides no additional information, but then makes me wonder if it's meant to be an example of a bad webpage and there's nothing wrong with my browser. Another failure of minimal…
This site isn't meant for general technical consumption. I don't understand why you would think otherwise. Why does this page have to explain what all the different cyber suites are, how SSL handshaking works, or why some hashes are no longer considered secure for cryptographic purposes? There are plenty of other websites out there that provide SSL primers. This website doesn't need to do that. This isn't a failure o…
He's not asking for a primer on SSL, but at least a sentence or two as to the purpose of the site.
Re: Bad SSL
#25I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…
I think it's showing examples of SSL gone wrong, so you know what you're looking at if it happens on your site.
Re: Bad SSL
#26I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…
This page isn't trying to sell you a product. I get that you're trying to give constructive feedback but if you don't know what you're looking at here, you can just ignore it and move on.
At best the submission title could use an edit so it's clearer what it is, that you don't have to click to ignore it.
Re: Bad SSL
#27I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…
From the github readme:
> badssl.com is meant for manual testing of security UI in web clients.
And my understanding is that green things are things that are good (security wise), red is bad. You'll have to test yourself if they work with your browser.
Re: Bad SSL
#28If this is meant for general technical consumption, it's sorely lacking in usability. After several seconds, I guessed that it might be referring to something about my browser. Some of the colours seem to indicate badness. Clicking on things provides no additional information, but then makes me wonder if it's meant to be an example of a bad webpage and there's nothing wrong with my browser. Another failure of minimal…
Took me awhile to figure out what's going on, way longer than it should have. A one-sentence description at the top would have cleared it up.
It is indeed the site itself that intends to be "bad". The site intentionally serves SSL certificates that are invalid or bad in various ways. Each subdomain is bad in a different way. You can test your code against these domains to ensure your code rejects the invalid or bad certificate.
Re: Bad SSL
#29I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…
This page isn't trying to sell you a product. I get that you're trying to give constructive feedback but if you don't know what you're looking at here, you can just ignore it and move on. At best the submission title could use an edit so it's clearer what it is, that you don't have to click to ignore it.
I thought his comments were constructive and useful.
Re: Bad SSL
#30An incredibly useful resource, well maintained by some of the best people in the PKI space, recently quoted by US-CERT [1] and so quick to use that I try it before starting to use any browser. A year ago it made me find out that the most popular iOS Tor browser doesn't check certificates at all. [2] (Use OnionBrowser instead.) [1] https://www.us-cert.gov/ncas/alerts/TA17-075A [2] https://twitter.com/FiloSottile/statu…
Clicking through to "very" is pretty amusing too.