4 ms·
Is it possible to give an 'upgrade' message to old browsers in this case though? If they fail the SSL handshake then they'll see a browser error before it loads
by omh 13y ago
Is it possible to give an 'upgrade' message to old browsers in this case though? If they fail the SSL handshake then they'll see a browser error before it loads anything from your site.
I agree with the principal of pushing people towards upgrading, but it's harder if you can't show them a helpful message to explain things.
- ivanr 13y agoIt's possible in some cases. For example, most sites continue to support SSL v3, even though only very old clients do not support TLS v1. So now would be a good time to tell those clients that they need to upgrade. If we don't do it now, SSL v3 might become too insecure for error messages. (Like, for example, SSL v2 is today.) With regards to BEAST, the problem is that a server has no way of telling if a client implements the mitigation technique. The only 100% safe assumption you can make is that the client negotiating TLS 1.0 is vulnerable.
- blueskin_ 13y agoThe server can make an educated guess based on the useragent. If someone is spoofing UA to an older browser, all bets are off, but then they presumably know what they are doing.
- deleted 13y ago[deleted]