3 ms·

You are probably aware of the Rating Guide: https://www.ssllabs.com/projects/rating-guide/ but would like to see scoring hints within the test itself? Th

by ivanr 13y ago

You are probably aware of the Rating Guide: https://www.ssllabs.com/projects/rating-guide/ but would like to see scoring hints within the test itself? The current scoring approach does not make that easy, which is the main reason why there are not more hints. I am planning a new version of the Rating Guide for next year, which will (most likely) be purely rule based, making it possible to explain the score in detail and, at the same time, point to the areas that need to be improved. There's a also the problem with the static-HTML design approach can no longer withstand the amount of information presented. In other words, it's time for v2, where we will apply what we've learned so far.

jvehent 13y ago
This is correct, I am looking for a way to understand the score from the UI directly. Glad to see it's on the roadmap for V2, and thanks for the hard work! As a side note, while researching this guideline, we found that the benefit of AES256 compared to 128 isn't as clear cut as it would seem [1]. So we decided to prefer AES 128 because it is still 25/30% faster. It also matches a proposal Brian Smith made for Firefox. So far, SSLLabs focuses on crypto strengh, and not on performance. I'd be interested to see the performance factor taken into account in the score calculation. [1] http://www.mail-archive.com/dev-tech-crypto@lists.mozilla.org/msg11325.html http://www.mail-archive.com/dev-tech-crypto@lists.mozilla.or...
- ivanr 13y ago
  The performance aspect will definitely be included in the next version. It's a valuable lesson (in human behaviour) I learned from the current version. People love getting higher and higher scores and, before, when the overall numerical score was included in the results, I observed many pushing their scores up with no good reason, impacting performance. One example was using 4096-bit RSA keys, which are an overkill for virtually everyone.

by ivanr 13y ago

jvehent 13y ago

This is correct, I am looking for a way to understand the score from the UI directly. Glad to see it's on the roadmap for V2, and thanks for the hard work! As a side note, while researching this guideline, we found that the benefit of AES256 compared to 128 isn't as clear cut as it would seem [1]. So we decided to prefer AES 128 because it is still 25/30% faster. It also matches a proposal Brian Smith made for Firefox. So far, SSLLabs focuses on crypto strengh, and not on performance. I'd be interested to see the performance factor taken into account in the score calculation. [1] http://www.mail-archive.com/dev-tech-crypto@lists.mozilla.org/msg11325.html http://www.mail-archive.com/dev-tech-crypto@lists.mozilla.or...

ivanr 13y ago
The performance aspect will definitely be included in the next version. It's a valuable lesson (in human behaviour) I learned from the current version. People love getting higher and higher scores and, before, when the overall numerical score was included in the results, I observed many pushing their scores up with no good reason, impacting performance. One example was using 4096-bit RSA keys, which are an overkill for virtually everyone.