3 ms·
I'll just throw this out there: Firefox is AFAIK not vulnerable to this.
by zobzu 13y ago
I'll just throw this out there:
Firefox is AFAIK not vulnerable to this.
- jvehent 13y agoFirefox is not vulnerable to this.
- tptacek 13y agoNSS had to adopt a fix for accepting bogus DH groups; was Firefox just not willing to accept a renegotiation under a different server certificate, or is something else going on here?
- agl 13y agoThe DH fix was just a sanity check and are not sufficient to prevent pre-master secret fixation with DH handshakes. Firefox enforces that the renegotiation certificate chain are valid for the site name which solves the renegotiation issue.