SSL client is Bad [released]
asked 2014-01-10 21:34:47 +0200
The site www.howsmyssl.com reports the current ssl implementation as Bad.
SSL: version = Improvable (1.2 would be better than current 1.1) Ephemeral Key Support = Good Session Ticket Support = Good TLS Compression = Good BEAST Vulnerability = Good Insecure Cipher Suites = Bad ("SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA: This cipher was meant to die with SSL 3.0 and is of unknown safety.")
The score is quire similar to Firefox 26, although Sailfish OS SSL version is more recent (1.1 for Jolla, 1.0 for Firefox)
It would be advisableto upgrade the Cipher Suite.
Sounds good.
Sailor ( 2014-01-10 23:05:58 +0200 )editYes it should - be better ;)
foss4ever ( 2014-01-11 02:19:05 +0200 )editThe page is only showing the supported cipher suites, but this bad cipher suite has not to be the default. So yes, the ssl implementation is using a insecure connection, but only if the server is not supporting a better one. So it is not that bad as shown on the start screen of this test.
balta ( 2014-01-11 07:51:46 +0200 )editYou can enable TLS 1.2 in the default browser to fix the main issue which makes the current configuration vulnerable, but you'll have to use a user.js file for it since about:config doesnt work in the browser.
vasavr ( 2014-02-06 01:39:30 +0200 )editadded to https://together.jolla.com/questions/4660
prometoys ( 2014-02-13 00:46:50 +0200 )edit