4 ms·

So these 1% sites make Mozilla's certificate revocation plan 'Too big to fail list'? Sounds like a bad security plan. You are only as strong as your weakest lin

So these 1% sites make Mozilla's certificate revocation plan 'Too big to fail list'? Sounds like a bad security plan. You are only as strong as your weakest link. Why is TLS 1.0 and 1.1 still enabled by default in Mozilla? More of the same. Big players don't want to tighten up.

icedchai 8y ago
If I had to guess, I'd say TLS probably isn't the weakest link... You ever wonder what's happening on the back end of some of these sites running with ancient certs?
- tialaramex 8y ago
  They're not that ancient, a typical leaf certificate affected by this issue will have been issued in July 2015 or later (maximum certificate lifetime of 39 months, now it's 825 days)
ethbro 8y ago
Mozilla, as far as I know, isn't beholden to any consumer sites for revenue? Instead of a generic "Something went wrong" TLS error message that's Greek to normal users and potentially causes blame to the browser, get aggressive. At this point, it's laziness or incompetence. -- "Warning: [WHOIS_COMPANY_NAME] is using a vulnerable certificate from Symantec. Criminals may be able to read anything you do on this site. Please email [WHO_ADMIN_CONTACT_EMAIL] about securing their site. Click [here] for more information about why Symantec certificates are no longer trusted."
- robin_reala 8y ago
  The actual Firefox message for a site using a Symantec cert on today’s nightly: Warning: Potential Security Risk Ahead Nightly detected a potential security threat and did not continue to [site].com. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details. Websites prove their identity via certificates, which are issued by certificate authorities. Most browsers will no longer trust Symantec, the certificate authority for [site].com. You may notify the website’s administrator about this problem.
  - londons_explore 8y ago
    I'd much prefer the browser continue to the site, but clear all cookies, treat the domain as an untrusted origin (so all CORS requests fail), and as soon as the user tries to type anything, pop up a big security warning saying "This site isn't secure! You shouldn't put any private data, passwords, or credit card numbers in". Then disable the keyboard entirely.
    - ethbro 8y ago
      Displaying the site but mangling functionality runs the risk of shifting blame to the browser, which I think is the primary tightrope in their mind. "Firefox won't let me do this" vs "ING's page is broken"
moviuro 8y ago
> Why is TLS 1.0 and 1.1 still enabled by default in Mozilla? Because PCI DSS still didn't obsolete TLS 1.1, probably. https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls https://blog.pcisecuritystandards.org/are-you-ready-for-30-j...

icedchai 8y ago

If I had to guess, I'd say TLS probably isn't the weakest link... You ever wonder what's happening on the back end of some of these sites running with ancient certs?

tialaramex 8y ago
They're not that ancient, a typical leaf certificate affected by this issue will have been issued in July 2015 or later (maximum certificate lifetime of 39 months, now it's 825 days)

ethbro 8y ago

Mozilla, as far as I know, isn't beholden to any consumer sites for revenue? Instead of a generic "Something went wrong" TLS error message that's Greek to normal users and potentially causes blame to the browser, get aggressive. At this point, it's laziness or incompetence. -- "Warning: [WHOIS_COMPANY_NAME] is using a vulnerable certificate from Symantec. Criminals may be able to read anything you do on this site. Please email [WHO_ADMIN_CONTACT_EMAIL] about securing their site. Click [here] for more information about why Symantec certificates are no longer trusted."

robin_reala 8y ago
The actual Firefox message for a site using a Symantec cert on today’s nightly: Warning: Potential Security Risk Ahead Nightly detected a potential security threat and did not continue to [site].com. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details. Websites prove their identity via certificates, which are issued by certificate authorities. Most browsers will no longer trust Symantec, the certificate authority for [site].com. You may notify the website’s administrator about this problem.
- londons_explore 8y ago
  I'd much prefer the browser continue to the site, but clear all cookies, treat the domain as an untrusted origin (so all CORS requests fail), and as soon as the user tries to type anything, pop up a big security warning saying "This site isn't secure! You shouldn't put any private data, passwords, or credit card numbers in". Then disable the keyboard entirely.
  - ethbro 8y ago
    Displaying the site but mangling functionality runs the risk of shifting blame to the browser, which I think is the primary tightrope in their mind. "Firefox won't let me do this" vs "ING's page is broken"

moviuro 8y ago

> Why is TLS 1.0 and 1.1 still enabled by default in Mozilla? Because PCI DSS still didn't obsolete TLS 1.1, probably. https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls https://blog.pcisecuritystandards.org/are-you-ready-for-30-j...