3 ms·
Following the bug comment[1][2], In Firefox 36, they will disable TLS downgrade with "security.tls.version.fallback-limit", but Those website: bookstore.*.edu
by ytch 12y ago
Following the bug comment[1][2],
In Firefox 36, they will disable TLS downgrade with "security.tls.version.fallback-limit", but
Those website: bookstore.*.edu use the same server and can only use TLS 1.0 [3]. So Firefox 37 will whitelist them to use old protocols/ciphers (TLS 1.0, RC4 and so on).
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1128227#c17 https://bugzilla.mozilla.org/show_bug.cgi?id=1128227#c17
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1084025 https://bugzilla.mozilla.org/show_bug.cgi?id=1084025
[3] https://www.ssllabs.com/ssltest/analyze.html?d=bookstore.hacc.edu https://www.ssllabs.com/ssltest/analyze.html?d=bookstore.hac...
- nailer 12y agoWhy white list them, rather than showing a warning about the insecure cyphers?