Re: Proposal: Disable SSLv3 in Firefox ESR 31

2014-10-20 Thread Julien Pierre
Kai, On 10/20/2014 16:47, Kai Engert wrote: On Mon, 2014-10-20 at 16:45 -0700, Julien Pierre wrote: What is the purpose of Firefox continuing to do any fallback at all ? IMO, making a second connection with any lower version of SSL/TLS defeats the intent of the SSL/TLS protocol, which have buil

Re: Proposal: Disable SSLv3 in Firefox ESR 31

2014-10-20 Thread Reed Loden
On Tue, 21 Oct 2014 01:40:45 +0200 Kai Engert wrote: > On Thu, 2014-10-16 at 20:51 +0200, Kai Engert wrote: > > Do you claim that Firefox 34 will continue to fall back to SSL 3 when > > necessary? > > Yes. If I understand correctly, it seems that Firefox indeed still falls > back to SSL3, even w

Re: Proposal: Disable SSLv3 in Firefox ESR 31

2014-10-20 Thread Kai Engert
On Mon, 2014-10-20 at 16:45 -0700, Julien Pierre wrote: > What is the purpose of Firefox continuing to do any fallback at all ? > IMO, making a second connection with any lower version of SSL/TLS > defeats the intent of the SSL/TLS protocol, which have built-in defenses > against protocol version

Re: Proposal: Disable SSLv3 in Firefox ESR 31

2014-10-20 Thread Julien Pierre
Kai, What is the purpose of Firefox continuing to do any fallback at all ? IMO, making a second connection with any lower version of SSL/TLS defeats the intent of the SSL/TLS protocol, which have built-in defenses against protocol version downgrade. Isn't it time this fallback gets eliminated

Re: Updates to the Server Side TLS guide

2014-10-20 Thread Julien Pierre
Hubert, On 10/20/2014 05:10, Hubert Kario wrote: So I went over the https://wiki.mozilla.org/Security/Server_Side_TLS article with a bit more attention to detail and I think we should extend it in few places. Especially if it is supposed to be also the general recommendation for servers, not ju

Re: Proposal: Disable SSLv3 in Firefox ESR 31

2014-10-20 Thread Kai Engert
On Thu, 2014-10-16 at 20:51 +0200, Kai Engert wrote: > Do you claim that Firefox 34 will continue to fall back to SSL 3 when > necessary? Yes. If I understand correctly, it seems that Firefox indeed still falls back to SSL3, even with SSL3 disabled. I found https://bugzilla.mozilla.org/show_bu

Using cmsutil to sign content with smartcard

2014-10-20 Thread claude . xavier
Hello, I'm trying to use cmsutils from the NSS library to sign content with a certificate from a smartcard. It works in Thunderbird/Icedove but I can't find the command that will do the same action. If I try (the mail address has been redacted): $ cmsutil -S -i /tmp/txt -o /tmp/sign -d ~/.iced

Using cmsutil to sign content with smartcard

2014-10-20 Thread Xavier Claude
Hello, I'm trying to use cmsutils from the NSS library to sign content with a certificate from a smartcard. It works in Thunderbird/Icedove but I can't find the command that will do the same action. If I try (the mail address has been redacted): $ cmsutil -S -i /tmp/txt -o /tmp/sign -d ~/.iced

Updates to the Server Side TLS guide

2014-10-20 Thread Hubert Kario
So I went over the https://wiki.mozilla.org/Security/Server_Side_TLS article with a bit more attention to detail and I think we should extend it in few places. Especially if it is supposed to be also the general recommendation for servers, not just for ones that are part of Mozilla network. The i