5 ms·

I'm using Version 42.0.2311.152 (64-bit) Chrome, so far it's still vulnerable to this. I believe it's the latest production version.

by methou 11y ago

buu700 11y ago
I'm running Version 43.0.2357.65 (64-bit) Chrome, which is also vulnerable to this. I believe it's the latest production version.
- nodesocket 11y ago
  43.0.2357.65 (64-bit) as well (latest), says is vulnerable.
  - ossreality 11y ago
    Well, let's put this to rest. The latest DEV is vulnerable. Chrome is vulnerable as of today, period. Version 44.0.2398.0 dev (64-bit)
  - deleted 11y ago
    [deleted]
  - captn3m0 11y ago
    I'm on the unstable channel here (44.0.2403.4 (Official Build) dev (64-bit)) and even that seems vulnerable.
- grrowl 11y ago
  Chrome 45.0.2407.0 canary (64-bit) is vulnerable too, so hopefully they address this before it is promoted to beta.
sanqui 11y ago
Firefox Developer Edition, which is on 40.0, is also reported as vulnerable.
- rockdoe 11y ago
  It's a bit strange this was published while the vulnerability isn't patched for the majority of users out there. Browsers vendors don't tend to lag security fixes, so why no responsible disclosure? Or is this just not really a browser issue, and held back on the browser side because blocking insecure ciphers breaks most of the internet?
  - lazyjones 11y ago
    > so why no responsible disclosure? Presumably because the main danger here comes from state-level adversaries who already know and actively exploit the issue, not script kiddies who might get funny ideas after reading the announcement. So the sooner it is published and people can start fixing their servers and clients, the less damage is done.
    - schoen 11y ago
      Yeah, a big part of the risk here is that someone might spend a couple million dollars and have a form of this capability up and running within a couple of months (and that governments may have done that by around 2010). If you want to improve your crypto, you can probably roll out a better configuration much faster than new adversaries can get these capabilities up and running. (Except for this Java compatibility problem, maybe.)
  - nuxi7 11y ago
    Because this isn't really an attack per se. There are some interesting things in the paper, but really this is just low grade crypto being tolerated for far too long in the name of compatibility. I finally found the Mozilla bug entry for this, they've known of it since 2010 when they raised the minimums to 512-bit DH groups. https://bugzilla.mozilla.org/show_bug.cgi?id=587407 https://bugzilla.mozilla.org/show_bug.cgi?id=587407

I'm using Version 42.0.2311.152 (64-bit) Chrome, so far it's still vulnerable to this. I believe it's the latest production version.

by methou 11y ago

I'm using Version 42.0.2311.152 (64-bit) Chrome, so far it's still vulnerable to this. I believe it's the latest production version.

buu700 11y ago

I'm running Version 43.0.2357.65 (64-bit) Chrome, which is also vulnerable to this. I believe it's the latest production version.

nodesocket 11y ago
43.0.2357.65 (64-bit) as well (latest), says is vulnerable.
- ossreality 11y ago
  Well, let's put this to rest. The latest DEV is vulnerable. Chrome is vulnerable as of today, period. Version 44.0.2398.0 dev (64-bit)
- deleted 11y ago
  [deleted]
- captn3m0 11y ago
  I'm on the unstable channel here (44.0.2403.4 (Official Build) dev (64-bit)) and even that seems vulnerable.
grrowl 11y ago
Chrome 45.0.2407.0 canary (64-bit) is vulnerable too, so hopefully they address this before it is promoted to beta.

sanqui 11y ago

Firefox Developer Edition, which is on 40.0, is also reported as vulnerable.

rockdoe 11y ago
It's a bit strange this was published while the vulnerability isn't patched for the majority of users out there. Browsers vendors don't tend to lag security fixes, so why no responsible disclosure? Or is this just not really a browser issue, and held back on the browser side because blocking insecure ciphers breaks most of the internet?
- lazyjones 11y ago
  > so why no responsible disclosure? Presumably because the main danger here comes from state-level adversaries who already know and actively exploit the issue, not script kiddies who might get funny ideas after reading the announcement. So the sooner it is published and people can start fixing their servers and clients, the less damage is done.
  - schoen 11y ago
    Yeah, a big part of the risk here is that someone might spend a couple million dollars and have a form of this capability up and running within a couple of months (and that governments may have done that by around 2010). If you want to improve your crypto, you can probably roll out a better configuration much faster than new adversaries can get these capabilities up and running. (Except for this Java compatibility problem, maybe.)
- nuxi7 11y ago
  Because this isn't really an attack per se. There are some interesting things in the paper, but really this is just low grade crypto being tolerated for far too long in the name of compatibility. I finally found the Mozilla bug entry for this, they've known of it since 2010 when they raised the minimums to 512-bit DH groups. https://bugzilla.mozilla.org/show_bug.cgi?id=587407 https://bugzilla.mozilla.org/show_bug.cgi?id=587407