Test browser for Logjam, Freak, Poodle vulnerabilities

[A Guy]

https://www.ssllabs.com/ssltest/viewMyClient.html

A Guy

 

[Callender]

No problems for me!

 

[ThrashZone]

Interesting not sure about these raspberries
View attachment 360333

 

[ThrashZone]

Pale moon looks like it needs an update :/
25.4.1 (64)

 

[Callender]

These settiings are what I have in Cyberfox. Should work in PaleMoon too.



Opera - old version needs these unchecked.

 

[Tookeri]

If your firewall only allows browser traffic on port 80(http) and 443(https) the test will show you're not vulnerable even if you are. That was the case for me.

According to this article Firefox is vulnerable but until an update is available you can set these to false:

• security.ssl3.dhe_rsa_aes_128_sha
• security.ssl3.dhe_rsa_aes_256_sha

 

[A Guy]

I'll just run with scissors

A Guy

 

[Loki]

A Guy don't forget to also text message while running with scissors

 

[groze]

I just hope this doesn't affect banking & shopping sites when the patch is issued by all browsers. Hopefully, this will be patched by the weekend for both windows, mac and Linux.

Internet explorer is the only browser that doesn't have the vulnerability on my system

 

[Callender]

Online Banking

I just hope this doesn't affect banking & shopping sites when the patch is issued by all browsers. Hopefully, this will be patched by the weekend for both windows, mac and Linux.

Internet explorer is the only browser that doesn't have the vulnerability on my system

Re: Online banking. For me it's impossible to carry out any transaction without a bank card, PIN number and card reader. Therefore even a hacker couldn't move money even if my browser was compromised.

 

[groze]

I just hope this doesn't affect banking & shopping sites when the patch is issued by all browsers. Hopefully, this will be patched by the weekend for both windows, mac and Linux.

Internet explorer is the only browser that doesn't have the vulnerability on my system

Re: Online banking. For me it's impossible to carry out any transaction without a bank card, PIN number and card reader. Therefore even a hacker couldn't move money even if my browser was compromised.

View attachment 360506

Actually U.S. is not that way yet but we are starting. We have chip and signature cards here, you have them as well but in the U.K. they are meant for the disabled and elderly that have trouble using or remembering pins. Not many merchants in my locations have them and at some wal-mart stores they do work but they also work as a swipe card for now.

 

[Callender]

Okay well it doesn't sound like your bank security will improve any time soon. If Firefox I use this add on to check cipher strength on secure sites.

SSL Sleuth

and this one too:

Calomel SSL Validation

Don't know of anything similar for IE though. These types of addons can be enabled / disabled when needed.

 

[Anak]

If your firewall only allows browser traffic on port 80(http) and 443(https) the test will show you're not vulnerable even if you are. That was the case for me.

According to this article Firefox is vulnerable but until an update is available you can set these to false:

• security.ssl3.dhe_rsa_aes_128_sha
• security.ssl3.dhe_rsa_aes_256_sha

Tookeri, I set those two to false and I'm now safe on the https://weakdh.org/ site, FF v38.0.1.

What do you or anyone else think about the others; Does the ec before the dhe make a difference?

 

[Callender]

There's some interesting information here:

Newly disclosed Logjam bug might be how the NSA broke VPNs

There's also a pdf technical report that can be downloaded. I'm trying to make sense of it but as far as I can work out it looks as though it depends on the server. For now I'm going to try disabling

security.ssl3.ecdhe_rsa_aes_128_sha
security.ssl3.ecdhe_rsa_aes_256_sha

and see if I get any problems connecting to websites.

 

[A Guy]

Tookeri, I set those two to false and I'm now safe on the https://weakdh.org/ site, FF v38.0.1.

When I visit https://weakdh.org in Opera 12.17



Irony?

A Guy

 

[GokAy]

Testing IE11 produces many Schannel 36888 errors in Event Viewer.

 

[Anak]

Chris, I saw that earlier using the link in Bill's original post, it's a good read....

Bill, v12.17? What do you get when you use v29?
The dhe512.zmap.io? It could be that the .io domain is in turmoil, this is what one site says about .io, but the wiki controversy on .io says the British Gov is in denial to the assertion that they are receiving any funds.
I wonder what the University of Michigan the creators of zmap thinks about using the .io domain: https://zmap.io/

I started using sslsleuth and calomel when Chris mentioned them back when poodle showed up and I see a lot of irony in sites that you would think should be secure, Microsoft has a 5.3 (orange) rating. What I've noticed when these revelations about cypher strength are revealed is there is a lot of variation in ratings until everyone catches up.

It's the adage; No matter your level of security, the last line of defense is the user clicking on an unknown link that gets him in trouble.

This is what I get when I visit weakdh.org:

 

[Callender]

Opera 12.17

Tookeri, I set those two to false and I'm now safe on the https://weakdh.org/ site, FF v38.0.1.

When I visit https://weakdh.org in Opera 12.17

View attachment 360607

Irony?

A Guy

I get the same but there is a setting somewhere that allows you to approve certificates but not keep them installed.

[ Edit: Approve on a temporary basis if required ]

For this particular site I rejected the certificate and it might just mean that the test depends upon either:

User approves certificate
Browser automatically accepts certificate

On another note - patched browsers are one thing but from what I read it's server side issues that are the problem and more specifically if you're talking about privacy, surveillance or data harvesting then email servers in particular.

 

[A Guy]

Bill, v12.17? What do you get when you use v29?

If I could install the newer versions side by side, I might have been keeping up. Even the "portable" version borked my Opera 12 install somehow. I had hopes for 1st Otter Browser, then Vivaldi, but alas, no Opera redux seems forthcoming. It's like when you have a favorite item at the supermarket, but very few others share your taste, so it disappears. Oh well, when they pull the plug, Pale Moon seems my next choice as of now. I will figure out how to make it more to my liking then.

A Guy

 

[Callender]

Opera 12.17 issues

Bill, v12.17? What do you get when you use v29?

If I could install the newer versions side by side, I might have been keeping up. Even the "portable" version borked my Opera 12 install somehow. I had hopes for 1st Otter Browser, then Vivaldi, but alas, no Opera redux seems forthcoming. It's like when you have a favorite item at the supermarket, but very few others share your taste, so it disappears. Oh well, when they pull the plug, Pale Moon seems my next choice as of now. I will figure out how to make it more to my liking then.

A Guy

I reached the same conclusion about Otter and Vivaldi. You might like to know that for those sites where you get that connection error that you've mentioned before in other threads it's actually possible to connect if you use Telerik Fiddler. I don't fully understand the technicalities but it does install it's own certificate and that seems to allow connection.

Try either of these sites in Opera 12.17:

https://www.404techsupport.com/

https://www.singularlabs.com/

I can't access either but with Fiddler running it allows connection.

Opera 12.17 screenshot:

[/INDENT]

Opera 12.17 with Fiddler running.

​

Usually I just switch to another browser to access problem websites but use this method occasionally.

Edit:

Also I'm aware that the only security patch that Opera 12.17 has received in a long time was the Heartbleed patch. For that reason I always run it under StripMyRights and it modifies the security token so that if any malware is encountered via the browser it only gets limited user rights instead of system wide priviledges - I use an account with admin rights. They say that malware usually obtains the same rights as the current user.

Opera unprotected:

​

Opera protected:



Command line needed for Opera Shortcut:

StripMyRights.exe /L N ""FullPathTo\opera.exe""