3 ms·

Bug 1130693 – bookstore.*.edu – “Secure connection failed”

4 points by yuhong 12y ago

yuhong 12y ago
Also look for "bookstore" in: https://bug1128227.bugzilla.mozilla.org/attachment.cgi?id=8560816 https://bug1128227.bugzilla.mozilla.org/attachment.cgi?id=85...
aftbit 12y ago
What's going on here?
- yuhong 12y ago
  The servers are TLS version intolerant. A proper TLS 1.0 implementation for example should return a TLS 1.0 ServerHello to any ClientHello mentioning a later version.
- ytch 12y ago
  Following the bug comment[1][2], In Firefox 36, they will disable TLS downgrade with "security.tls.version.fallback-limit", but Those website: bookstore.*.edu use the same server and can only use TLS 1.0 [3]. So Firefox 37 will whitelist them to use old protocols/ciphers (TLS 1.0, RC4 and so on). [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1128227#c17 https://bugzilla.mozilla.org/show_bug.cgi?id=1128227#c17 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1084025 https://bugzilla.mozilla.org/show_bug.cgi?id=1084025 [3] https://www.ssllabs.com/ssltest/analyze.html?d=bookstore.hacc.edu https://www.ssllabs.com/ssltest/analyze.html?d=bookstore.hac...
  - nailer 12y ago
    Why white list them, rather than showing a warning about the insecure cyphers?
yzzxy 12y ago
I'm not sure what's notable about this bug - I think most of these sites are run by the same company but that's the only point of interest I can find.
- yuhong 12y ago
  I am looking for contact information.
Create 12y ago
Guarding patrons' library activities is considered a core value of the profession, written into the ALA's code of ethics: "We protect each library user's right to privacy and confidentiality with respect to information sought or received and resources consulted, borrowed, acquired or transmitted." Over the years, the U.S. government has tested the limits of how far librarians will go to defend that code. Near the end of the Cold War, FBI agents asked New York City librarians to watch for patrons who might be diplomats from foreign hostile powers trying to recruit intelligence agents or gathering intelligence. http://boingboing.net/2014/10/12/librarians-on-the-vanguard-of.html http://boingboing.net/2014/10/12/librarians-on-the-vanguard-... http://www.washingtonpost.com/blogs/the-switch/wp/2014/10/03/librarians-wont-stay-quiet-about-government-surveillance/?Post+generic=%3Ftid%3Dsm_twitter_washingtonpost http://www.washingtonpost.com/blogs/the-switch/wp/2014/10/03...

4 points by yuhong 12y ago

Also look for "bookstore" in: https://bug1128227.bugzilla.mozilla.org/attachment.cgi?id=8560816 https://bug1128227.bugzilla.mozilla.org/attachment.cgi?id=85...

aftbit 12y ago

What's going on here?

yuhong 12y ago
The servers are TLS version intolerant. A proper TLS 1.0 implementation for example should return a TLS 1.0 ServerHello to any ClientHello mentioning a later version.
ytch 12y ago
Following the bug comment[1][2], In Firefox 36, they will disable TLS downgrade with "security.tls.version.fallback-limit", but Those website: bookstore.*.edu use the same server and can only use TLS 1.0 [3]. So Firefox 37 will whitelist them to use old protocols/ciphers (TLS 1.0, RC4 and so on). [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1128227#c17 https://bugzilla.mozilla.org/show_bug.cgi?id=1128227#c17 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1084025 https://bugzilla.mozilla.org/show_bug.cgi?id=1084025 [3] https://www.ssllabs.com/ssltest/analyze.html?d=bookstore.hacc.edu https://www.ssllabs.com/ssltest/analyze.html?d=bookstore.hac...
- nailer 12y ago
  Why white list them, rather than showing a warning about the insecure cyphers?

yzzxy 12y ago

I'm not sure what's notable about this bug - I think most of these sites are run by the same company but that's the only point of interest I can find.

yuhong 12y ago
I am looking for contact information.

Create 12y ago

Guarding patrons' library activities is considered a core value of the profession, written into the ALA's code of ethics: "We protect each library user's right to privacy and confidentiality with respect to information sought or received and resources consulted, borrowed, acquired or transmitted." Over the years, the U.S. government has tested the limits of how far librarians will go to defend that code. Near the end of the Cold War, FBI agents asked New York City librarians to watch for patrons who might be diplomats from foreign hostile powers trying to recruit intelligence agents or gathering intelligence. http://boingboing.net/2014/10/12/librarians-on-the-vanguard-of.html http://boingboing.net/2014/10/12/librarians-on-the-vanguard-... http://www.washingtonpost.com/blogs/the-switch/wp/2014/10/03/librarians-wont-stay-quiet-about-government-surveillance/?Post+generic=%3Ftid%3Dsm_twitter_washingtonpost http://www.washingtonpost.com/blogs/the-switch/wp/2014/10/03...