Hacker News Reader

Comment by valarauca1 | Hacker News Reader

The second bullet is important, having up to date TLS is a big deal in today's security/spy conscience world. Its possible to currently get (if you monkey around in about:config), but default settings are powerful since the average user won't bother. And I mean average-user type average user, not average hackernews reader/poster.

View on HN

How's My SSL? [1] now reports "Your SSL client is Probably Okay." for Firefox 27. Awesome!

[1] https://www.howsmyssl.com/

An error occurred during a connection to www.howsmyssl.com. Peer attempted old style (potentially vulnerable) handshake.

I don't think I would trust their judgement about how my SSL is doing.

I am happy about this Firefox release; it is not just that you had to be an advanced user to get TLS 1.2 previously but that doing so would break over half the web. Now it is possible to use TLS 1.2 where available and not use it when not available.

Maybe that was it probing you?

Fedora 20 (firefox 26), "Your SSL client is Bad." :(

I just fixed that by setting:

  security.tls.version.max = 3
  security.tls.version.min = 1
  security.ssl3.rsa_fips_des_ede3_sha = false

in about:config, after which it also said "Probably good" for FF26.

It is good, now all the latest major browsers support TLS1.2 with forward secrecy. It is unfortunate that IE doesn't put FS suits first though.

For you Windows server operators out there, I suggest IISCrypto to order your cipher selection (this works on desktop versions of Windows too).

https://www.nartac.com/Products/IISCrypto/

Except how many people trust absolutely every single CA in the huge list that browser comes with. It only takes one of them (or even a single intermediate CA that is listed by them) to sign a malicious key and the whole system is compromised.

And it already happened few times (ex. http://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulen...).

Imagine what US government agency can do.

Reply on news.ycombinator.com