6 ms·

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

by trentmb 13y ago

thirdsight 13y ago
Thanks. Just did that on my FF 26.0 on windows and it passes now as well. Rather surprised it was dumping down TLS 1.0!
- gcp 13y ago
  New TLS versions (1.1/1.2) have been included since Firefox 24, but won't be enabled by default until Firefox 27. https://bugzilla.mozilla.org/show_bug.cgi?id=733647 https://bugzilla.mozilla.org/show_bug.cgi?id=733647 https://bugzilla.mozilla.org/show_bug.cgi?id=861266 https://bugzilla.mozilla.org/show_bug.cgi?id=861266
mathrawka 13y ago
Why is that not set by default?
- gcp 13y ago
  Breaks on some broken websites without a bunch of fallbacks/workarounds in place. They are in newer Firefox versions, though.
- handsomeransoms 13y ago
  TLS 1.2 will be enabled by default in the next release, Firefox 27, which will be released the week of February 4th. So, in less than 4 weeks, Firefox release will be "good".
FPSDavid 13y ago
Are there any downsides of changing these settings?
- trentmb 13y ago
  Some (poorly configured) servers may not play nicely.
MWil 13y ago
anything wrong with setting both the min AND max to 3?
- djcapelis 13y ago
  Some websites may not work over TLS if they don't support it.
  - MWil 13y ago
    yeah I found that out already. So far so good with most of my regular sites with min: 2, max:3
    - pyroMax 13y ago
      Try: https://apple.com https://apple.com without the www part. Update: https://www.microsoft.com https://www.microsoft.com also breaks.
jjjeffrey 13y ago
Say I change security.tls.version.max to 3, which changes it's status from 'default' to 'user set'. In the future, if the default for security.tls.version.max is changed to, say, 4, would the fact that my setting has the 'user set' status prevent it from incrementing to the better default? I'm not proposing that this is a risk or that Firefox behaves this way---I have no idea. Does anyone else know?
- djcapelis 13y ago
  I believe it would, but I'm not certain. This is one of reasons not to mess with it and just wait until the next version which will be out RSN (real soon now) that has a better default. For whatever it's worth though, while I'm not sure how they're doing their version numbers and it may be quite awhile until this is relevant, you could probably just set the integer really high (like 99 or something) and that would effectively translate into "try the highest version you've got" which might break things sometimes, but it wouldn't leave you stuck in a lower version later at least.
- erichurkman 13y ago
  Often with settings like this, they will flip the preference name to something like `security.tls.max_version` or something so user-set and extension-set overrides are invalidated. They've done this with other common, significant settings that users often overrode.
- hsivonen 13y ago
  The (non-about:config) UI for these settings was removed for a reason. Even though it makes sense for these to be configurable for testing, end users are more likely to break their browser (make it less secure or make it incompatible with real sites they need to use) by tweaking these settings. Firefox developers have had to reset these settings in the past in order to save users from self-inflicted insecurity. Without an explicit effort by Firefox developers to reset these prefs, the prefs won't automatically reset to make sense in the future if the value space of the prefs grows. There is no guarantee of what explicit effort might be taken to deal with non-default values of these prefs in the future. In my opinion, anyone who wants https://www.howsmyssl.com/ https://www.howsmyssl.com/ to tell them they are probably okay today should install Firefox Beta (or Aurora or Nightly) instead of manually changing these settings. (Disclosure: I'm a Gecko developer but I don't work on TLS. Disclaimer: The above is my personal understanding and opinion, not any sort of official statement.)
jftuga 13y ago
Thanks. This made my FF 26.0 go from Bad to Probably Okay.
ddp 13y ago
I recommend disabling all the RC4 suites as well.

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

by trentmb 13y ago

It only took changing two settings in about:config to get FF 26 to 'pass.' security.tls.version.max = 3 security.ssl3.rsa_fips_des_ede3_sha = false

thirdsight 13y ago

Thanks. Just did that on my FF 26.0 on windows and it passes now as well. Rather surprised it was dumping down TLS 1.0!

gcp 13y ago
New TLS versions (1.1/1.2) have been included since Firefox 24, but won't be enabled by default until Firefox 27. https://bugzilla.mozilla.org/show_bug.cgi?id=733647 https://bugzilla.mozilla.org/show_bug.cgi?id=733647 https://bugzilla.mozilla.org/show_bug.cgi?id=861266 https://bugzilla.mozilla.org/show_bug.cgi?id=861266

mathrawka 13y ago

Why is that not set by default?

gcp 13y ago
Breaks on some broken websites without a bunch of fallbacks/workarounds in place. They are in newer Firefox versions, though.
handsomeransoms 13y ago
TLS 1.2 will be enabled by default in the next release, Firefox 27, which will be released the week of February 4th. So, in less than 4 weeks, Firefox release will be "good".

FPSDavid 13y ago

Are there any downsides of changing these settings?

trentmb 13y ago
Some (poorly configured) servers may not play nicely.

MWil 13y ago

anything wrong with setting both the min AND max to 3?

djcapelis 13y ago
Some websites may not work over TLS if they don't support it.
- MWil 13y ago
  yeah I found that out already. So far so good with most of my regular sites with min: 2, max:3
  - pyroMax 13y ago
    Try: https://apple.com https://apple.com without the www part. Update: https://www.microsoft.com https://www.microsoft.com also breaks.

jjjeffrey 13y ago

Say I change security.tls.version.max to 3, which changes it's status from 'default' to 'user set'. In the future, if the default for security.tls.version.max is changed to, say, 4, would the fact that my setting has the 'user set' status prevent it from incrementing to the better default? I'm not proposing that this is a risk or that Firefox behaves this way---I have no idea. Does anyone else know?

djcapelis 13y ago
I believe it would, but I'm not certain. This is one of reasons not to mess with it and just wait until the next version which will be out RSN (real soon now) that has a better default. For whatever it's worth though, while I'm not sure how they're doing their version numbers and it may be quite awhile until this is relevant, you could probably just set the integer really high (like 99 or something) and that would effectively translate into "try the highest version you've got" which might break things sometimes, but it wouldn't leave you stuck in a lower version later at least.
erichurkman 13y ago
Often with settings like this, they will flip the preference name to something like `security.tls.max_version` or something so user-set and extension-set overrides are invalidated. They've done this with other common, significant settings that users often overrode.
hsivonen 13y ago
The (non-about:config) UI for these settings was removed for a reason. Even though it makes sense for these to be configurable for testing, end users are more likely to break their browser (make it less secure or make it incompatible with real sites they need to use) by tweaking these settings. Firefox developers have had to reset these settings in the past in order to save users from self-inflicted insecurity. Without an explicit effort by Firefox developers to reset these prefs, the prefs won't automatically reset to make sense in the future if the value space of the prefs grows. There is no guarantee of what explicit effort might be taken to deal with non-default values of these prefs in the future. In my opinion, anyone who wants https://www.howsmyssl.com/ https://www.howsmyssl.com/ to tell them they are probably okay today should install Firefox Beta (or Aurora or Nightly) instead of manually changing these settings. (Disclosure: I'm a Gecko developer but I don't work on TLS. Disclaimer: The above is my personal understanding and opinion, not any sort of official statement.)

jftuga 13y ago

Thanks. This made my FF 26.0 go from Bad to Probably Okay.

ddp 13y ago

I recommend disabling all the RC4 suites as well.