Hacker News Reader

Comment by mrb | Hacker News Reader

And they do HTTPS right (at least on 18f.gsa.gov) - it's pretty rare to see an HTTPS site get an "A" grade from Qualys' SSL server test. No weak ciphers supported, no support for SSL v2/v3 (only newer TLS), most ciphers support PFS, etc: https://www.ssllabs.com/ssltest/analyze.html?d=18f.gsa.gov

Edit: not all their sites are doing HTTPS right :-/ 18F developed https://www.notalone.gov and this site has quite a few security issues: https://www.ssllabs.com/ssltest/analyze.html?d=notalone.gov&...

View on HN

Thanks! But actually, it pains me that we're still showing a SHA-1 cert.

Because bureaucracy, we're still waiting on a replacement SHA-2 cert, which once installed will bring our score up to an A+ like this:

https://www.ssllabs.com/ssltest/analyze.html?d=staging.18f.u...

We're changing up processes internally that will speed things up. The subject of a future post!

EDIT: And yeah, we're aware of the notalone.gov issues. There's some legacy infrastructure there, but we'll try to get it fixed up. Our future sites will be stronger.

Do you have to maintain backward compatibility with Windows XP pre-SP3 for gov sites? That would require SHA-1 certs and SSLv3.

I don't know about 18F's perspective but most of the places I've heard about upgraded off of XP rather than deal with it not being supported (waivers aren't a given, require work and paid support hits already-tight budgets). Not even installing SP3 would be even harder to justify and that's one of the areas where the increased security panic is actually useful.

Yea, MS does offer custom support for older service packs too but it has been years since XP SP2 left support.

Every site is going to have a different sort of userbase, so it's tough to make sweeping proclamations about support. I don't think we'll have trouble using SHA-2 in our deployments.

Yeah, I'm sure there are exceptions lurking around – the world is too big not to be – but I'd also be surprised if those lingering remnants were in widespread, internet-facing use.

Reply on news.ycombinator.com