4 ms·
Quite a few servers (for example, any server using the version of OpenSSL in Debian Squeeze) do not support anything newer than TLS 1.0, so you'll get quite a b
by agwa 13y ago
Quite a few servers (for example, any server using the version of OpenSSL in Debian Squeeze) do not support anything newer than TLS 1.0, so you'll get quite a bit of breakage if you disable it.
TLS 1.0 in Firefox 26.0 should be secure; it implements 1/n-1 record splitting, so it's safe against BEAST even though this website reports otherwise.
- gcb0 13y agoHear this. This site is mostly FUD. http://security.stackexchange.com/questions/32817/why-dont-major-browsers-currently-support-tls-above-version-1-0 http://security.stackexchange.com/questions/32817/why-dont-m...
- agwa 13y agoThe site is mostly OK. It just needs to properly test for the BEAST vulnerability (ideally it would check for a 1 byte record, but a whitelist of user agents known to implement 1/n-1 record splitting would suffice in the interim), instead of assuming anyone with TLSv1.0 is vulnerable. And it should rate TLSv1.0 (with record splitting) as "Improvable" rather than "Bad". But yes, being faced with a huge "Your SSL client is Bad" banner when visiting from up-to-date Firefox is FUD.