3 ms·

Thanks for the test (very useful!) and for the update. A couple of comments: "Servers that do not support Forward Secrecy with our reference browsers are give

Thanks for the test (very useful!) and for the update. A couple of comments: "Servers that do not support Forward Secrecy with our reference browsers are given a warning." Why aren't such servers capped to a non-A rating? Also, the current scoring scheme that puts Cipher Strength among the bars at the top but doesn't put Forward Secrery there. Is there a reason to believe that it's more worthwhile to highligh symmetric cipher key length than to highlight Forward Secrecy, including the DH group size? Considering that the security of AES256 might be closer to AES128 per https://www.schneier.com/blog/archives/2009/07/new_attack_on_a.html https://www.schneier.com/blog/archives/2009/07/new_attack_on... and running more rounds might give more opportunity for timing attacks in case a round isn't constant-time, it seems weird to me to highlight the lack of AES256 more than DH group size. Likewise, it seems weird to highlight the difference between AES128 and AES256 more than the difference between RC4 and AES.

ivanr 13y ago
I guess that some decisions are easier to make than others. It's quite clear, for example, that protocols before TLS 1.2 are inadequate. Forward Secrecy, on the other hand, is supremely important for some sites (e.g., Google) and not at all important for others (e.g., SSL Labs). Also relevant is that these new rules are added on top of the 2009 rating guide, which does not offer an adequate framework for them. Just as an illustration, there is currently no meaning behind the A-F grades. A is good, and F is bad, clearly, but we don't know what the grades in between mean. Same response to your ciphers question. I can't stretch the current approach to go handle those small differences. The calculations made some sense at the time, but they no longer work for everything we want to take into account. I currently working a new version of the rating guide--from scratch--and it's going to solve all those problems, and a few more.

ivanr 13y ago

I guess that some decisions are easier to make than others. It's quite clear, for example, that protocols before TLS 1.2 are inadequate. Forward Secrecy, on the other hand, is supremely important for some sites (e.g., Google) and not at all important for others (e.g., SSL Labs). Also relevant is that these new rules are added on top of the 2009 rating guide, which does not offer an adequate framework for them. Just as an illustration, there is currently no meaning behind the A-F grades. A is good, and F is bad, clearly, but we don't know what the grades in between mean. Same response to your ciphers question. I can't stretch the current approach to go handle those small differences. The calculations made some sense at the time, but they no longer work for everything we want to take into account. I currently working a new version of the rating guide--from scratch--and it's going to solve all those problems, and a few more.