3 ms·
Does Firefox 23 have support for TLSv1.2? Please fix NSS and support TLSv1.2 As of now only IE and Opera are the ones which I'm aware of that support TLSv1.2.
by filereaper 14y ago
Does Firefox 23 have support for TLSv1.2?
Please fix NSS and support TLSv1.2
As of now only IE and Opera are the ones which I'm aware of that support TLSv1.2.
There is a vulnerability for BEAST against SSL 3.0/TLSv1.0
With more widespread use of HTTPS which isn't a bad thing, it would help that all browsers support the latest security recommendations.
https://blogs.akamai.com/2012/05/what-you-need-to-know-about-beast.html https://blogs.akamai.com/2012/05/what-you-need-to-know-about...
- KNoureen 14y agoFirefox 23 does not have TLS v1.2, but Nightly will very soon. During March there have been very active development in NSS for TLS v1.2 and they are AFAIK checking in bit by bit now.
- ctz 14y agoThere's no point implementing TLS1.2 until browsers stop silently downgrading through TLS versions under attacker control. And there's not much prospect of that happening: it seems we're happy to exchange compatibility with less than 1% of sites for security of 100%.
- peterwwillis 14y agoFrom what i've read, it looks like the server advertises all the TLS it supports, the client picks the highest version, but then an attacker sends an RST and the client goes to the next version in the list. Is that accurate? (The only other downgrade attack I saw was on False Start which has since been disabled in Chrome) Could (or should) they support an option in the browser to require only the highest possible version of a protocol? Or is there some other fix required to mitigate the attack?