Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bad SSL

badssl.com

Post reply on HN
Print view View original

31–40 of 93 posts

Re: Bad SSL

#31

Post by gizmo »

dmethvin wrote: post #18
gizmo wrote: post #16

Earlier quoted context omitted.

This site isn't meant for general technical consumption. I don't understand why you would think otherwise. Why does this page have to explain what all the different cyber suites are, how SSL handshaking works, or why some hashes are no longer considered secure for cryptographic purposes? There are plenty of other websites out there that provide SSL primers. This website doesn't need to do that. This isn't a failure o…

He might think otherwise because it climbed to the top of HN but doesn't have any explanation (here or on the actual page) of what it does or who/what it might be useful for.

And for people who are curious they can read the comments here that explain what it does or click on the large github banner in the corner and check out the README.

Calling this site a "failure of minimalism" is unnecessary and mean.

Re: Bad SSL

#33

Post by simias »

delinka wrote: post #22

I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…

Took me a little while to understand as well but it's supposed to test your client. You browser should be able to display the green links without errors and should refuse to navigate to the red ones since they are insecure for one reason or an other (weak algorithms, broken SSL etc...)

Re: Bad SSL

#34

Post by goblin89 »

So far it appears that latest Safari on macOS is fully vulnerable to pinning, would only alert about a revoked certificate on second access to the page (?), and doesn’t care about insecure password/credit card forms.

Re: Bad SSL

#35

Post by gizmo »

watter wrote: post #20
gizmo wrote: post #16

Earlier quoted context omitted.

This site isn't meant for general technical consumption. I don't understand why you would think otherwise. Why does this page have to explain what all the different cyber suites are, how SSL handshaking works, or why some hashes are no longer considered secure for cryptographic purposes? There are plenty of other websites out there that provide SSL primers. This website doesn't need to do that. This isn't a failure o…

It should at LEAST say it is targeting the browser for the tests, not someone's ssl site. I had no idea it was testing my phone until I went to the other test site link in the footer. I can't believe you go to such length defending the "UX" when it isn't even obvious what the test is for. Seriously.

The site has no such obligation. The site is for a very specific target audience: people who write web clients/web browsers. So the site isn't created for you, and it isn't meant for general consumption, and it doesn't have to explain anything.

It's a tool for web client developers, like it says in the github README. Which is one click away.

If the developers of this tool posted this as a SHOW HN, then yes, you'd have a point. But that's not what happened here.

Re: Bad SSL

#37

Post by raverbashing »

Semaphor wrote: post #27
delinka wrote: post #22

I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL? Oh, these things are clickable. "This pages contains a lone password field not wrapped in a tag." Um ... yeah? Oh, you're saying that my browser renders t…

From the github readme: > badssl.com is meant for manual testing of security UI in web clients. And my understanding is that green things are things that are good (security wise), red is bad. You'll have to test yourself if they work with your browser.

No, that's what it looks like, though

Open the dashboard and it's more 'verbose'.

Red means it didn't connect to that site as it shouldn't in certain situations

Re: Bad SSL

#38

Post by watter »

gizmo wrote: post #35
watter wrote: post #20

Earlier quoted context omitted.

It should at LEAST say it is targeting the browser for the tests, not someone's ssl site. I had no idea it was testing my phone until I went to the other test site link in the footer. I can't believe you go to such length defending the "UX" when it isn't even obvious what the test is for. Seriously.

The site has no such obligation. The site is for a very specific target audience: people who write web clients/web browsers. So the site isn't created for you, and it isn't meant for general consumption, and it doesn't have to explain anything. It's a tool for web client developers, like it says in the github README. Which is one click away. If the developers of this tool posted this as a SHOW HN, then yes, you'd hav…

Actually I am a developer and this is useful to my work so it is targeted exactly at someone like me. It would still help to have a description without going to github.

Just some /constructive/ feedback...

Re: Bad SSL

#39

Post by acdha »

raverbashing wrote: post #7

Good concept, but the usability is bad If you see the dashboard things are clearer, but there's a mismatch between connected/not connected and what they were supposed to do.

I think you're right but missing the context: badssl.com was setup as a resource for security engineers who are running tests. It's great for that and it allows the kind of fine-grained testing which anyone who is developing software, configuring firewalls or group policy, etc. would want — i.e. if you do anything which consumes HTTPS, why not take the time to add a step to your CI process which prevents accidental regressions?

The dashboard (https://badssl.com/dashboard/) is very new — see https://github.com/chromium/badssl.com/issues/257 — and as the person who opened that issue, my context was different: that conversation started among a group of U.S. federal government employees who are often in the situation of needing to use a MITM SSL proxy for compliance reasons and don't directly control it, often lacking even the ability to install software on their primary workstation (not without cause, given the threat model). Being able to run tests in a browser and send the helpdesk a single link saying “These three boxes should not be red, please file high-priority ticket with the network group” is really useful for getting changes through quickly.

Re: Bad SSL

#40

Post by raverbashing »

acdha wrote: post #39
raverbashing wrote: post #7

Good concept, but the usability is bad If you see the dashboard things are clearer, but there's a mismatch between connected/not connected and what they were supposed to do.

I think you're right but missing the context: badssl.com was setup as a resource for security engineers who are running tests. It's great for that and it allows the kind of fine-grained testing which anyone who is developing software, configuring firewalls or group policy, etc. would want — i.e. if you do anything which consumes HTTPS, why not take the time to add a step to your CI process which prevents accidental r…

Ah I see

It's an interesting concept and service, no doubt about it, but giving the test results as Pass/Fail would be more helpful ;)

Post reply on HN