6 ms·
If you're implementing a new TLS library from scratch, why not reduce the available cryptographic agility and get rid of vulnerable versions? This implementatio
by throwawaymath 8y ago
If you're implementing a new TLS library from scratch, why not reduce the available cryptographic agility and get rid of vulnerable versions? This implementation would be strictly more secure if it ripped out TLS 1.0 and 1.1 and didn't use RSA for anything.
I don't mean to critique an honest effort here, if someone wants to make their own implementation that's great. But the world has enough cryptography that isn't secure by default, and I don't think backwards compatibility should be encouraged.
How's My SSL [1] is a good resource (ignore that it still uses SSL nomenclature instead of TLS). To give an example, whenever I have to set up a new Nginx instance with HTTPS these days I remove TLS 1.0/1.1 support and disable half or so of the available cipher suites letsencrypt gives you out of the box.
_____________________
1. https://www.howsmyssl.com https://www.howsmyssl.com
- iforgotpassword 8y ago> I don't think backwards compatibility should be encouraged. Since you're talking about setting up a web server you can mostly get away with this, esp. since most people are on auto updating chrome, so it's not an issue. But try to configure your browser to be that restrictive and you'll get pretty annoyed very soon. I tried this about a year ago. Horrible experience.
- lousken 8y agoI've set this up 3 months ago. So far only about dozen domains I visited were not reachable using TLSv1.2 or 1.3. I messaged to all admins and half of them fixed that already, other half either said it's not currently possible for that website because it's running on very old server or didn't reply at all.
- sitkack 8y agoIs there an effort to build a whitelist for sites using old TLS versions?
- lousken 8y agoI don't have any plans for creating such whitelist, if webmasters and sysadmins don't respond to my emails they will be forced by browsers anyway - in one year the most commonly used browsers will disable TLS 1.0 and 1.1 with an update [0]. For now it serves as a good warning that such webserver isn't updated and might be hacked sooner or later. With pretty much every distribution released in last ten years you can patch it so that apache/nginx or whatever will use TLS 1.2 and if you're using something even older it probably shouldn't be on the internet anyway. [0] https://www.zdnet.com/article/chrome-edge-ie-firefox-and-safari-to-disable-tls-1-0-and-tls-1-1-in-2020/ https://www.zdnet.com/article/chrome-edge-ie-firefox-and-saf...
- iforgotpassword 8y agoSorry, I probably should have been more explicit. I was also referring to the part where they suggested disabling weak ciphers, like explicitly stated in GP, RSA. That's what caused problems for me.
- lousken 8y agoThat depends on what do you consider as a weak cipher, I do have security.ssl3.rsa_des_ede3_sha set to false in Firefox as well. If you mean all ciphers that don't have forward secrecy then I guess it may broke a lot more. edit: i also have security.ssl3.rsa_aes_256_sha disabled, so my only non forward secrecy cipher fallback is TLS_RSA_WITH_AES_128_CBC_SHA
- dependenttypes 8y agoI would suggest to avoid disabling ciphers in your browser as it can damage your privacy.
- toast0 8y agoTLS 1.2 is from late 2008, so it's pretty reasonable to start support from there unless you have a good reason. It's embarassaing that Android didn't enable support for TLS 1.2 everywhere until 5.0 (lollipop), but that was released late 2014, and most of 4 _can_ use 1.2 if you use the right options when making your sockets. And most people stopped supporting anything before Android 4.
- userbinator 8y agoIndeed, there's a very long tail of sites out there which still have useful and hard-to-find niche information but haven't upgraded to newer software, and I don't blame them for it --- since they're usually self-hosted, if you complain they're more likely to just shut it off, which would be even worse.
- floatboth 8y agoI have Firefox configured to reject 1.0 and 1.1. Pretty much the only thing that refused to connect was a university's learning management system. The vast majority of websites support TLS 1.2.
- iforgotpassword 8y agoYeah, but 1.2 still supports a lot of "shitty" ciphers. Try disabling them too...
- dgzl 8y agoEvery once in a while I envision a desolate future where survival is dependant on scavengers being able to break into discarded computer systems. At which point, weak crypto would actually save the world.