Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by filereaper | Hacker News Reader

Parent Full thread

filereaper·

Does Firefox 23 have support for TLSv1.2?

Please fix NSS and support TLSv1.2

As of now only IE and Opera are the ones which I'm aware of that support TLSv1.2.

There is a vulnerability for BEAST against SSL 3.0/TLSv1.0

With more widespread use of HTTPS which isn't a bad thing, it would help that all browsers support the latest security recommendations.

https://blogs.akamai.com/2012/05/what-you-need-to-know-about...

View on HN

Firefox 23 does not have TLS v1.2, but Nightly will very soon. During March there have been very active development in NSS for TLS v1.2 and they are AFAIK checking in bit by bit now.

There's no point implementing TLS1.2 until browsers stop silently downgrading through TLS versions under attacker control.

And there's not much prospect of that happening: it seems we're happy to exchange compatibility with less than 1% of sites for security of 100%.

From what i've read, it looks like the server advertises all the TLS it supports, the client picks the highest version, but then an attacker sends an RST and the client goes to the next version in the list. Is that accurate? (The only other downgrade attack I saw was on False Start which has since been disabled in Chrome)

Could (or should) they support an option in the browser to require only the highest possible version of a protocol? Or is there some other fix required to mitigate the attack?

Reply on news.ycombinator.com