Re: moznss with openldap - error -8018:Unknown PKCS #11 error

2013-08-20 Thread Augustin Wolf
Fixed: I did: -recreate /etc/openldap/certs moznss database -chown root:ldap -R /etc/openldap/certs/ -chmod 640 /etc/openldap/certs/* -recreate /etc/openldap/slap.d/ now it works like a charm I was missing either file permission to read the database, or there was mismatch between pkcs12 key and

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-08-20 Thread Kurt Roeckx
On 08/09/2013 04:30 AM, Brian Smith wrote: Please see https://briansmith.org/browser-ciphersuites-01.html First, this is a proposal to change the set of sequence of ciphersuites that Firefox offers. So I think there are a whole bunch of things where we have 2 options, and it's not always

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-08-20 Thread Kurt Roeckx
On Mon, Aug 19, 2013 at 08:06:49PM +0200, Kurt Roeckx wrote: I understand that the MAC itself doesn't make much difference, but we should probably avoid MD5. I see no SHA256 MACs except for GCM which probably isn't a problem. I'm having mixed feelings about SHA1 / SHA256. I think it makes

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-08-20 Thread Gervase Markham
On 19/08/13 04:07, Brian Smith wrote: When risk is there to a user of having a network eavesdropper able to tell that they are using a particular browser? If I had an exploit for a particular browser, I'd just try it anyway and see if it worked. That seems to be the normal pattern. One

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-08-20 Thread Tom Ritter
On 20 August 2013 14:26, Gervase Markham g...@mozilla.org wrote: On 19/08/13 04:07, Brian Smith wrote: When risk is there to a user of having a network eavesdropper able to tell that they are using a particular browser? If I had an exploit for a particular browser, I'd just try it anyway and