4 ms·

The second bullet is important, having up to date TLS is a big deal in today's security/spy conscience world. Its possible to currently get (if you monkey aroun

The second bullet is important, having up to date TLS is a big deal in today's security/spy conscience world. Its possible to currently get (if you monkey around in about:config), but default settings are powerful since the average user won't bother. And I mean average-user type average user, not average hackernews reader/poster.

pixl97 13y ago
It is good, now all the latest major browsers support TLS1.2 with forward secrecy. It is unfortunate that IE doesn't put FS suits first though. For you Windows server operators out there, I suggest IISCrypto to order your cipher selection (this works on desktop versions of Windows too). https://www.nartac.com/Products/IISCrypto/ https://www.nartac.com/Products/IISCrypto/
erichurkman 13y ago
How's My SSL? [1] now reports "Your SSL client is Probably Okay." for Firefox 27. Awesome! [1] https://www.howsmyssl.com/ https://www.howsmyssl.com/
- joveian 13y ago
  An error occurred during a connection to www.howsmyssl.com. Peer attempted old style (potentially vulnerable) handshake. I don't think I would trust their judgement about how my SSL is doing. I am happy about this Firefox release; it is not just that you had to be an advanced user to get TLS 1.2 previously but that doing so would break over half the web. Now it is possible to use TLS 1.2 where available and not use it when not available.
  - gaius 13y ago
    Maybe that was it probing you?
- hnwhatevz 13y ago
  Fedora 20 (firefox 26), "Your SSL client is Bad." :(
  - skion 13y ago
    I just fixed that by setting: security.tls.version.max = 3 security.tls.version.min = 1 security.ssl3.rsa_fips_des_ede3_sha = false in about:config, after which it also said "Probably good" for FF26.
takeda 13y ago
Except how many people trust absolutely every single CA in the huge list that browser comes with. It only takes one of them (or even a single intermediate CA that is listed by them) to sign a malicious key and the whole system is compromised. And it already happened few times (ex. http://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulent_certificates http://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulen...). Imagine what US government agency can do.

pixl97 13y ago

It is good, now all the latest major browsers support TLS1.2 with forward secrecy. It is unfortunate that IE doesn't put FS suits first though. For you Windows server operators out there, I suggest IISCrypto to order your cipher selection (this works on desktop versions of Windows too). https://www.nartac.com/Products/IISCrypto/ https://www.nartac.com/Products/IISCrypto/

erichurkman 13y ago

How's My SSL? [1] now reports "Your SSL client is Probably Okay." for Firefox 27. Awesome! [1] https://www.howsmyssl.com/ https://www.howsmyssl.com/

joveian 13y ago
An error occurred during a connection to www.howsmyssl.com. Peer attempted old style (potentially vulnerable) handshake. I don't think I would trust their judgement about how my SSL is doing. I am happy about this Firefox release; it is not just that you had to be an advanced user to get TLS 1.2 previously but that doing so would break over half the web. Now it is possible to use TLS 1.2 where available and not use it when not available.
- gaius 13y ago
  Maybe that was it probing you?
hnwhatevz 13y ago
Fedora 20 (firefox 26), "Your SSL client is Bad." :(
- skion 13y ago
  I just fixed that by setting: security.tls.version.max = 3 security.tls.version.min = 1 security.ssl3.rsa_fips_des_ede3_sha = false in about:config, after which it also said "Probably good" for FF26.

takeda 13y ago

Except how many people trust absolutely every single CA in the huge list that browser comes with. It only takes one of them (or even a single intermediate CA that is listed by them) to sign a malicious key and the whole system is compromised. And it already happened few times (ex. http://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulent_certificates http://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulen...). Imagine what US government agency can do.