Slashdot Mirror
Firefox Moving On From SSL 2.0
Juha-Matti Laurio writes "Plans are afoot to remove support for SSL version 2.0 in Mozilla Firefox, reports MozillaZine portal. Mozilla Foundation is eager to disable support for SSL 2.0 and have all Firefox installations use only the newer and more secure SSL 3.0 and TLS 1.0 protocols." From the post: "Netscape Communications Corporation introduced SSL 2.0 with the launch of Netscape Navigator 1.0 in 1994. Netscape Navigator 2.0 included support for SSL 3.0 when it was released in 1996. The specification for TLS 1.0, essentially a standardized version of SSL 3.0 with some differences, was published in 1999."
How will this affect the end user? Will it break the online banking webs?
--
Superb hosting 4800MB Storage, 120GB bandwidth, $7,95.
Kunowalls!!! Random sexy wallpapers (NSFW!).
Hosting 20G hd, 1Tb bw! ssh $7.95
Why remove - why not just disable, and make it an entry in a config file to re-enable it? I'm all for removing any software that is insecure, but this might cause trouble for users trying to access sites. It's all about choice, people.
Get your own free personal location tracker
All the good times we have shared with SSL 2.0 now they will be gone. SSL 2.0 will locked in it's room sobbing and won't come out for a week. Well Firefox, I hope your satisfied, go on! Go off with your new Friends, see if SSL 2.0 cares.
Oh and SSL 2.0 want's it's ring back, otherwise there will be a messy lawsuit.
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Ooo! You're right! We better tell people to stop using RSA and HTTP immediately!
:-)
Be careful about such sweeping statements, please. They're more often wrong that right. And I know of quite a few people who are happy that RSA is finally out of patent protection.
Javascript + Nintendo DSi = DSiCade
If this technology is 11 years old, then I don't think anyone would like to use it today. Especially if it's encryption standard.
RSA was designed in 1977.
Age means absolutely nothing (for any technology), and instead any calls for replacement need to detail exactly what the weaknesses are and how they've been resolved in newer variants.
What always amazes me about the Mozilla Foundation is the push to support the newest and latest.
Now everybody might be thinking this is good for security and all; but I like it because of other reasons: namely because it allows to me exude tech eliteness amongst normal Windows users. Yep, I'm serious. I'm an IT admin, and people will tell me, "Dude, how do I stop spyware?" What do I say?
I preach Firefoxism and nobody can argue back. What can they say? Um, IE has really awesome, um...Active-something controls...which causes the spyware in my computer to make my machine inoperable...um...yeah. It's great. And no matter what Microsoft puts out, it'll always be one step behind! Thanks Mozilla!
IGB: More fun than eating oatmeal!
Hrm... wonder how long it take Microsoft to come out with a statement saying FF is becoming less secure, as they are taking out security functions.
Watch for Penguins, they eat Apples and throw rocks at Windows.
You can do the same thing in IE by going to Tools | Options | Advanced | Security. What is kind of amusing is that TLS 1.0 seems to be off for me. Not that I use it but still... heh
Anyway, if you're worried about it breaking a site you *must* use, try disabling it.
Gonzo Granzeau
"Nothing the god of biomechanics wouldn't let you into heaven for.." -Roy Batty
Good move by Mozilla.
At the very least, this has prompted more attention to the fact that SSL 2.0 is not so secure.
Even if some sites continue to use it, it is never a bad idea to bring attention to a flawed security system when a fix is easily available.
Of course, some of us now might have to have two legacy browsers installed in order to use all the sites we want to (IE & an older FF) -- unless SSL 2.0 is reversibly disabled.
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
At least since 2002. Haven't had a problem with a single major site, including banks and financial institutions. I also wonder when the support for TLS 1.1 will be incorporated.
I would like to change the world,
but they won't tell me the source code.
The link posted in that site won't display the problem -- visit the wiki to display the problem (https://register.btinternet.com/ is a current offender).
I've been using POP to fetch my e-mail from the same address for 11 years.
The problem with Mozilla is that they're so swamped with bugs that some developers at least seem to have stopped caring about *any* bugs at all whatsoever anymore - to the point where they will not only not fix them, but actively try to prevent others from fixing them. Give bug 18574 a look some time, for example...
Unfortunately, there's not really much you can do. Firefox *is* wildly popular, so those at the top of the Mozilla foundation (Asa Dotzler etc.) don't even realise that some things are going wrong - they've stopped listening to the people, just like Microsoft has, after convincing themselves that those who disagree are just a small bunch of disgruntled nay-sayers. Considering Firefox' popularity, that's not a difficult thing to do, but it's still wrong - you should always listen to your users.
Unfortunately, it seems that Mozilla is heading further in this direction, with the creation of a new for-profit company that's supposed to take over from the non-profit organisation and all that. I fear that this will be used as an excuse to listen to the actual users even less - and I don't doubt that this new incarnation of Netscape (which is what it'll be, essentially) will reward Asa and co with a nice monthly sum for the whole thing, too.
In the end, what it really boils down to is PR vs. the actual product - if PR (i.e., telling people that your product is good) is more important than actually *making* your product good, everyone loses. The only exception are those at the top of the pyramid who make money that way - but the actual users will lose out, and that's even sadder when you consider that projects with more PR will usually attract more users, too.
Microsoft (Windows), Mozilla, MySQL - this is what they all have in common. They're all not really all that great at what they're supposed to do, but there's so much PR that they're still successful. And unlike with Windows and MySQL, where you have Linux/*BSD and PostgreSQL as free and better alternatives, there seems to be no real alternative to Mozilla - Opera is payware, Konqueror only runs on Linux/KDE, Safari is for OS X etc. Where is the free, no-crap browser for Windows? There seems to be none.
quidquid latine dictum sit altum videtur.
I can confirm that there are at least 100 sites out there that use SSL 2.0 only.
A few examples follow (turn off SSL 2 to see the problems):
https://secure.muttluks.com./
https://www.wilmerhalealumni.com./
https://www.burinka.cz./
Sig Appended to the end of comments you post. 120 chars.
I've been using POP to fetch my e-mail from the same address for 11 years.
:)
Oh, I'm so sorry. . .
Maybe you should look into IMAP!
Can I get an eye poke?
Dog House Forum
That the desire to remove the technology also makes the job of testing easier, especially when dealing with security related code, I am sure that testing of this is more of annoyance. People expect it to be secure and unexploitable. Then you can focus your development and patches on new code.
This isn't just about making stuff compatible for the users. Then the developers can focus on MSIE quicky mode rendering instead of SSL 2.0!
D.O.U.O.S.V.A.V.V.M.
Sorry, maybe I'm missing something:
But why is it a big deal that they're upgrading?
I thought this was a news site: not freshmeat or version tracker.
Is there some other item of importance here that I'm missing?
- - - -
KickingDragon
> The problem with Mozilla is that they're so swamped with bugs that some
> developers at least seem to have stopped caring about *any* bugs at all
> whatsoever anymore - to the point where they will not only not fix them,
> but actively try to prevent others from fixing them. Give bug 18574 a
> look some time, for example...
If this bug is typical of the sort of thing you're complaining about, go soak your head. If it were me, I'd have closed that bug as NOTABUG aeons ago. There are an infinite number of bizarroid image formats out there that, for one reason or another (in some cases good reasons, in some cases not, but that is neither here nor there) have not become important or common on the web. MNG is an ideal example and practically a case study in irrelevancy; it has been languishing in irrelevancy for years and shows absolutely ZERO signs of EVER breaking out of that and gaining any significant mindshare or import. The component owner is absolutely right to exclude this sort of nonsense. Mozilla is *not* primarily an image viewer; it is primarily a web browser, so the image formats it should support are ones that are *used on the web*, not every single obscure image format someone thinks is cool. (And that's quite aside from the fact that the main selling point of MNG is that it supports animation, something right-thinking people have been wanting to rid the web of since some misguided cretinous loser decided to introduce looping animated GIFs in Netscape 2.0; the only thing worse than animations on the web was the <blink> tag, may it rest in pieces.)
You speak of preventing bugs from being fixed, but if this is what you're talking about, you should speak of preventing irrelevant features that aren't even vaguely web-related from being needlessly introduced into a web browser.
Cut that out, or I will ship you to Norilsk in a box.
It's a troll, but I'll bite and see if I can get a free worm.
This is just wrong. A bit of research (http://weblogs.mozillazine.org/asa/, http://planet.mozilla.org/ shows that the developers, including Asa, routinely listen to users and often ask for comments. And from the point of view of an insider (bugs I've reported: 55), developers respond quickly and helpfully to anyone who isn't wasting their time, and even those who are but do it in a curteous way.
A few other specific points: the Mozilla Corporation is not for-profit. Nothing about a corporation says it has to be. It merely falls under business laws, making it easier for other businesses to interact with Mozilla.
And with respect to bug 18574, it's the one about MNG support. To quote a few things from the bug:
There are 11 types of people in the world: those who can count in binary, and those who can't.
by keeping SSL 2.0, you maintain backward compatability for virtually zero-cost
The problem is that SSL 2.0 servers will hang on a 3.0 handshake. So the 2.0 handshake is tried first.
Meaning that for servers configured to respond to both 2.0 and 3.0, you end up using the worst one. So that is the non-zero cost they try to avoid.
- Keep on supporting them forever.
- Stop supporting them and force them to upgrade.
#2 is usually the right thing to do. It's especially right in this case. Every single line of code that processes remote user input (ie, every line of SSL and any other web server code) could potentially contain a security vulnerability. Developers are not actively working on this antique code so bugs will be left there, perhaps forever. If you're looking for holes, abandoned code is a good place to look. This is similar to the Linux vulnerability not long ago where there was some obscure bug in the processing of a.out files that let binaries escalate. Well, we don't use a.out format anymore. We use ELF format and have for years, so no one was paying attention to that antique code. It should have been removed from the kernel, but it wasn't.The second issue is that OpenSSL is maintained by volunteers. I'd rather have them working to make a small set of features perfect, instead of wasting time on dead code that almost no one is using. Would you rather have the GCC crew working on improving Java or Fortran support?
Apache has 70% of the market, IIS has about 20%, yet the the former has only two unpatched holes.
Since Apache is more popular (by 3 1/2 times), you'd think it would have 3 1/2 unpatched vulnerabilities, eh?
So Apache 2 has had 27 Secunia advisories, with 2 still unpatched, and IIS 6 has only had 3, of which one is still unpatched. Seems to support the GP's theory pretty well. Your point?