Removing SSLv3 in Chrome • Hacker News Board

Re: Removing SSLv3 in Chrome

#31

Post by cesarb » Fri, Oct 31, 2014, 10:33 AM UTC

0x0 wrote: post #21

scrollaway wrote: post #19

Earlier quoted context omitted.

Yes, absolutely. Controversial content of all sorts (activism, gay rights, sex, etc) gets censored all over the planet and gets people on watchlists. When you are talking about the potential for controversy itself creating this problem, then yeah, HTTPS becomes a benefit everywhere. "Oh but we just host cute pictures!" - doesn't matter. Maybe someone commented on one of those pictures and said something about China b…

There's a huge difference between ssh and ssl's trust model, where the latter requires you to fork over money for each domain name(1) and at the same time trust ALL the other CAs in the world not to work against you. (1) except for a couple of very inflexible free tiers at a couple of vendors, which caused more trouble than it was worth during heartbleed. For SSH your key management is 100% in your hands and no third…

The perfect is the enemy of good. With TLS, you reduce the MITM exposure from "everyone who is in the path between you and the server" to "everyone who is in the path between you and the server, AND has control of or has hacked into a CA AND is willing to risk the CA being blacklisted by the major browsers".

The latter category is much smaller than the former (which includes anyone in the public access point you're using, for instance). Yeah, the NSA is probably in the latter category (if they think you're important enough to risk burning a CA), but the NSA is not your only adversary.

Re: Removing SSLv3 in Chrome

#32

Post by pluma » Fri, Oct 31, 2014, 10:47 AM UTC

lnanek2 wrote: post #27

The only time Chrome's over-zealous security has even shown up for me is when it doesn't let me login to WiFi that requires a login page. Which happens a lot. Oh, and maybe once the site in question had an expired certificate and I had to use another browser to access it. Wonderful.

Have you tried clicking the small "Advanced" link on the error page and then selecting "Go there anyway"?

Re: Removing SSLv3 in Chrome

#33

Post by 0x0 » Fri, Oct 31, 2014, 10:48 AM UTC

cesarb wrote: post #30

mcosta wrote: post #15

Earlier quoted context omitted.

> encrypted HTTP everywhere Do you really think everything, everything deserves encrypted comunication? cat photos too?

TLS is not just about encryption. It's also about authentication. Without it, your cat photos site can have malicious Javascript injected into it by malicious middleboxes. In fact, the canonical way to exploit POODLE is by injecting a Javascript code into a non-SSL-protected page, which will do repeated requests to the SSL-protected page. If the user were to only access SSL-protected pages, and never went to an attac…

Unless there's an XSS somewhere, which is unfortunately all too common.

Re: Removing SSLv3 in Chrome

#34

Post by cube00 » Fri, Oct 31, 2014, 10:50 AM UTC

atesti wrote: post #29

I have an old raid controller from 3ware. The management software runs on localhost, but for illadvised security reasons forces HTTPS. One day I was not able to connect anymore (with a browser running on that machine!) I had to hunt down an old version of Firefox to still be able to connect. Therefore it is a bad idea to not provide a fallback. It's good if every login over the internet is proteceted by HTTPS and wea…

Keeping code around doesn't come free, it still needs to be maintained, tested, and provides an additional attack vector. You need to draw the line somewhere. As pointed out in the post TLS 1.0 is 15 years old and things are still using SSLv3.

Re: Removing SSLv3 in Chrome

#35

Post by iSnow » Fri, Oct 31, 2014, 12:25 PM UTC

atesti wrote: post #29

I have an old raid controller from 3ware. The management software runs on localhost, but for illadvised security reasons forces HTTPS. One day I was not able to connect anymore (with a browser running on that machine!) I had to hunt down an old version of Firefox to still be able to connect. Therefore it is a bad idea to not provide a fallback. It's good if every login over the internet is proteceted by HTTPS and wea…

Why not keep a virtual machine frozen at a 2013 OS and browser around?

Re: Removing SSLv3 in Chrome

#36

Post by TD-Linux » Fri, Oct 31, 2014, 4:12 PM UTC

lnanek2 wrote: post #27

The only time Chrome's over-zealous security has even shown up for me is when it doesn't let me login to WiFi that requires a login page. Which happens a lot. Oh, and maybe once the site in question had an expired certificate and I had to use another browser to access it. Wonderful.

This is a problem on Firefox too now. It is due to the new ability for the browser to remember that pages are HTTPS only. For these routers, I generally use example.com as a non-HTTPS website to hit the login.