3 ms·

I've set this up 3 months ago. So far only about dozen domains I visited were not reachable using TLSv1.2 or 1.3. I messaged to all admins and half of them fixe

I've set this up 3 months ago. So far only about dozen domains I visited were not reachable using TLSv1.2 or 1.3. I messaged to all admins and half of them fixed that already, other half either said it's not currently possible for that website because it's running on very old server or didn't reply at all.

sitkack 8y ago
Is there an effort to build a whitelist for sites using old TLS versions?
- lousken 8y ago
  I don't have any plans for creating such whitelist, if webmasters and sysadmins don't respond to my emails they will be forced by browsers anyway - in one year the most commonly used browsers will disable TLS 1.0 and 1.1 with an update [0]. For now it serves as a good warning that such webserver isn't updated and might be hacked sooner or later. With pretty much every distribution released in last ten years you can patch it so that apache/nginx or whatever will use TLS 1.2 and if you're using something even older it probably shouldn't be on the internet anyway. [0] https://www.zdnet.com/article/chrome-edge-ie-firefox-and-safari-to-disable-tls-1-0-and-tls-1-1-in-2020/ https://www.zdnet.com/article/chrome-edge-ie-firefox-and-saf...
iforgotpassword 8y ago
Sorry, I probably should have been more explicit. I was also referring to the part where they suggested disabling weak ciphers, like explicitly stated in GP, RSA. That's what caused problems for me.
- lousken 8y ago
  That depends on what do you consider as a weak cipher, I do have security.ssl3.rsa_des_ede3_sha set to false in Firefox as well. If you mean all ciphers that don't have forward secrecy then I guess it may broke a lot more. edit: i also have security.ssl3.rsa_aes_256_sha disabled, so my only non forward secrecy cipher fallback is TLS_RSA_WITH_AES_128_CBC_SHA
  - dependenttypes 8y ago
    I would suggest to avoid disabling ciphers in your browser as it can damage your privacy.

sitkack 8y ago

Is there an effort to build a whitelist for sites using old TLS versions?

lousken 8y ago
I don't have any plans for creating such whitelist, if webmasters and sysadmins don't respond to my emails they will be forced by browsers anyway - in one year the most commonly used browsers will disable TLS 1.0 and 1.1 with an update [0]. For now it serves as a good warning that such webserver isn't updated and might be hacked sooner or later. With pretty much every distribution released in last ten years you can patch it so that apache/nginx or whatever will use TLS 1.2 and if you're using something even older it probably shouldn't be on the internet anyway. [0] https://www.zdnet.com/article/chrome-edge-ie-firefox-and-safari-to-disable-tls-1-0-and-tls-1-1-in-2020/ https://www.zdnet.com/article/chrome-edge-ie-firefox-and-saf...

iforgotpassword 8y ago

Sorry, I probably should have been more explicit. I was also referring to the part where they suggested disabling weak ciphers, like explicitly stated in GP, RSA. That's what caused problems for me.

lousken 8y ago
That depends on what do you consider as a weak cipher, I do have security.ssl3.rsa_des_ede3_sha set to false in Firefox as well. If you mean all ciphers that don't have forward secrecy then I guess it may broke a lot more. edit: i also have security.ssl3.rsa_aes_256_sha disabled, so my only non forward secrecy cipher fallback is TLS_RSA_WITH_AES_128_CBC_SHA
- dependenttypes 8y ago
  I would suggest to avoid disabling ciphers in your browser as it can damage your privacy.