Slashdot Mirror
Firefox Moving On From SSL 2.0
Juha-Matti Laurio writes "Plans are afoot to remove support for SSL version 2.0 in Mozilla Firefox, reports MozillaZine portal. Mozilla Foundation is eager to disable support for SSL 2.0 and have all Firefox installations use only the newer and more secure SSL 3.0 and TLS 1.0 protocols." From the post: "Netscape Communications Corporation introduced SSL 2.0 with the launch of Netscape Navigator 1.0 in 1994. Netscape Navigator 2.0 included support for SSL 3.0 when it was released in 1996. The specification for TLS 1.0, essentially a standardized version of SSL 3.0 with some differences, was published in 1999."
How will this affect the end user? Will it break the online banking webs?
--
Superb hosting 4800MB Storage, 120GB bandwidth, $7,95.
Kunowalls!!! Random sexy wallpapers (NSFW!).
Hosting 20G hd, 1Tb bw! ssh $7.95
All the good times we have shared with SSL 2.0 now they will be gone. SSL 2.0 will locked in it's room sobbing and won't come out for a week. Well Firefox, I hope your satisfied, go on! Go off with your new Friends, see if SSL 2.0 cares.
Oh and SSL 2.0 want's it's ring back, otherwise there will be a messy lawsuit.
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Ooo! You're right! We better tell people to stop using RSA and HTTP immediately!
:-)
Be careful about such sweeping statements, please. They're more often wrong that right. And I know of quite a few people who are happy that RSA is finally out of patent protection.
Javascript + Nintendo DSi = DSiCade
If this technology is 11 years old, then I don't think anyone would like to use it today. Especially if it's encryption standard.
RSA was designed in 1977.
Age means absolutely nothing (for any technology), and instead any calls for replacement need to detail exactly what the weaknesses are and how they've been resolved in newer variants.
What always amazes me about the Mozilla Foundation is the push to support the newest and latest.
Now everybody might be thinking this is good for security and all; but I like it because of other reasons: namely because it allows to me exude tech eliteness amongst normal Windows users. Yep, I'm serious. I'm an IT admin, and people will tell me, "Dude, how do I stop spyware?" What do I say?
I preach Firefoxism and nobody can argue back. What can they say? Um, IE has really awesome, um...Active-something controls...which causes the spyware in my computer to make my machine inoperable...um...yeah. It's great. And no matter what Microsoft puts out, it'll always be one step behind! Thanks Mozilla!
IGB: More fun than eating oatmeal!
Hrm... wonder how long it take Microsoft to come out with a statement saying FF is becoming less secure, as they are taking out security functions.
Watch for Penguins, they eat Apples and throw rocks at Windows.
You can do the same thing in IE by going to Tools | Options | Advanced | Security. What is kind of amusing is that TLS 1.0 seems to be off for me. Not that I use it but still... heh
Anyway, if you're worried about it breaking a site you *must* use, try disabling it.
Gonzo Granzeau
"Nothing the god of biomechanics wouldn't let you into heaven for.." -Roy Batty
Good move by Mozilla.
At the very least, this has prompted more attention to the fact that SSL 2.0 is not so secure.
Even if some sites continue to use it, it is never a bad idea to bring attention to a flawed security system when a fix is easily available.
Of course, some of us now might have to have two legacy browsers installed in order to use all the sites we want to (IE & an older FF) -- unless SSL 2.0 is reversibly disabled.
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
At least since 2002. Haven't had a problem with a single major site, including banks and financial institutions. I also wonder when the support for TLS 1.1 will be incorporated.
I would like to change the world,
but they won't tell me the source code.
That *is* what they're going to do.
main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
I can confirm that there are at least 100 sites out there that use SSL 2.0 only.
A few examples follow (turn off SSL 2 to see the problems):
https://secure.muttluks.com./
https://www.wilmerhalealumni.com./
https://www.burinka.cz./
Sig Appended to the end of comments you post. 120 chars.
by keeping SSL 2.0, you maintain backward compatability for virtually zero-cost
The problem is that SSL 2.0 servers will hang on a 3.0 handshake. So the 2.0 handshake is tried first.
Meaning that for servers configured to respond to both 2.0 and 3.0, you end up using the worst one. So that is the non-zero cost they try to avoid.