5 ms·

Are you sure? I'm running Firefox 38.0.5 and Chromium 40.0.2214.91 through normal channels (ie, not nightly builds...) and they are both NOT vulnerable.

by kardos 11y ago

ikeboy 11y ago
40.0.2214.91 was released months ago http://googlechromereleases.blogspot.com/2015/01/stable-update.html http://googlechromereleases.blogspot.com/2015/01/stable-upda.... (Irony of no https). https://bugzilla.mozilla.org/show_bug.cgi?id=1166031 https://bugzilla.mozilla.org/show_bug.cgi?id=1166031 and https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 say explicitly wontfix for 38.0.5 Maybe you manually fixed it some time ago and don't remember? Check both https://weakdh.org/ https://weakdh.org/ and https://www.ssllabs.com:10445/ https://www.ssllabs.com:10445/
- takeda 11y ago
  38.0.5 is safe. I learned it myself when trying to use internal service. Secure Connection Failed An error occurred during a connection to 10.xx.yy.xx. SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message. (Error code: ssl_error_weak_server_ephemeral_dh_key) - The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. - Please contact the website owners to inform them of this problem. I wish they gave option to bypass it.
  - MBlume 11y ago
    I'm running 38.0.5, the weakdh page says I'm vulnerable
    - what_the_diffie 11y ago
      It's hard to tell from the paper, because they don't include either specific build version numbers of browsers / servers nor date of publication, so their results are difficult (e.g., impossible) to reproduce exactly. 0: https://weakdh.org/imperfect-forward-secrecy.pdf https://weakdh.org/imperfect-forward-secrecy.pdf
    - takeda 11y ago
      Interesting, weakdh says I'm safe... Both on Mac and OpenSuSE.
- kardos 11y ago
  Ah, it appears that the patches made their way into my distro's packages. I tested both with weakdh.org before posting previous comment.
deleted 11y ago
[deleted]
what_the_diffie 11y ago
These major browsers (latest stable on OS X) are currently vulnerable: - Chrome 43.0.2357.124 - Firefox 38.0.5 - Safari 8.0.6 (10600.6.3) Not vulnerable - Opera 30.0.1835.59 Reference: https://www.ssllabs.com/ssltest/viewMyClient.html https://www.ssllabs.com/ssltest/viewMyClient.html

Are you sure? I'm running Firefox 38.0.5 and Chromium 40.0.2214.91 through normal channels (ie, not nightly builds...) and they are both NOT vulnerable.

by kardos 11y ago

Are you sure? I'm running Firefox 38.0.5 and Chromium 40.0.2214.91 through normal channels (ie, not nightly builds...) and they are both NOT vulnerable.

ikeboy 11y ago

40.0.2214.91 was released months ago http://googlechromereleases.blogspot.com/2015/01/stable-update.html http://googlechromereleases.blogspot.com/2015/01/stable-upda.... (Irony of no https). https://bugzilla.mozilla.org/show_bug.cgi?id=1166031 https://bugzilla.mozilla.org/show_bug.cgi?id=1166031 and https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 say explicitly wontfix for 38.0.5 Maybe you manually fixed it some time ago and don't remember? Check both https://weakdh.org/ https://weakdh.org/ and https://www.ssllabs.com:10445/ https://www.ssllabs.com:10445/

takeda 11y ago
38.0.5 is safe. I learned it myself when trying to use internal service. Secure Connection Failed An error occurred during a connection to 10.xx.yy.xx. SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message. (Error code: ssl_error_weak_server_ephemeral_dh_key) - The page you are trying to view cannot be shown because the authenticity of the received data could not be verified. - Please contact the website owners to inform them of this problem. I wish they gave option to bypass it.
- MBlume 11y ago
  I'm running 38.0.5, the weakdh page says I'm vulnerable
  - what_the_diffie 11y ago
    It's hard to tell from the paper, because they don't include either specific build version numbers of browsers / servers nor date of publication, so their results are difficult (e.g., impossible) to reproduce exactly. 0: https://weakdh.org/imperfect-forward-secrecy.pdf https://weakdh.org/imperfect-forward-secrecy.pdf
  - takeda 11y ago
    Interesting, weakdh says I'm safe... Both on Mac and OpenSuSE.
kardos 11y ago
Ah, it appears that the patches made their way into my distro's packages. I tested both with weakdh.org before posting previous comment.

deleted 11y ago

[deleted]

what_the_diffie 11y ago

These major browsers (latest stable on OS X) are currently vulnerable: - Chrome 43.0.2357.124 - Firefox 38.0.5 - Safari 8.0.6 (10600.6.3) Not vulnerable - Opera 30.0.1835.59 Reference: https://www.ssllabs.com/ssltest/viewMyClient.html https://www.ssllabs.com/ssltest/viewMyClient.html