3 ms·
What's going on here?
by aftbit 12y ago
What's going on here?
- yuhong 12y agoThe servers are TLS version intolerant. A proper TLS 1.0 implementation for example should return a TLS 1.0 ServerHello to any ClientHello mentioning a later version.
- ytch 12y agoFollowing the bug comment[1][2], In Firefox 36, they will disable TLS downgrade with "security.tls.version.fallback-limit", but Those website: bookstore.*.edu use the same server and can only use TLS 1.0 [3]. So Firefox 37 will whitelist them to use old protocols/ciphers (TLS 1.0, RC4 and so on). [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1128227#c17 https://bugzilla.mozilla.org/show_bug.cgi?id=1128227#c17 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1084025 https://bugzilla.mozilla.org/show_bug.cgi?id=1084025 [3] https://www.ssllabs.com/ssltest/analyze.html?d=bookstore.hacc.edu https://www.ssllabs.com/ssltest/analyze.html?d=bookstore.hac...
- nailer 12y agoWhy white list them, rather than showing a warning about the insecure cyphers?