A Williams wrote on 17/10/14 21.33:
You know Google reported a hole in SSL at the start of the week? It was around
the time the latest Firefox came out and they were planning to disable SSL
support with the next level in mid November.
Hi,
yes I already new about the SSL3 bug.
I don't have the newest Seamonkey yet (it has not propagated to my Linux
distribution yet) but Apple *may* possibly have taken this step already.
Firefox disabled configuration except by about:config last year but Seamonkey
did not.
Preferences -> Privacy & Security -> SSL -> SSL Protocol Versions.
Is SSL 3.0 enabled?
btw:
- the checked boxes have to be contiguous.
- SSL 3.0 < TLS 1.0.
It does not work.
The error is not about the cypher used, but about the certificate not being
recognised even if it's in the exception list. I do have SSL3 enabled on SM.
Google will tell you how to do this for Firefox. It was non-intuitive to me.
I agree with you.
The hole in SSL was large enough to make disabling it a sensible idea. My
preference would be towards leaving it off rather than keeping it for localhost.
Disabling SSL3 by default will forbid you to connect to a lot of services, most
of them on shared hostings; at least this is how FF now works (badly) if you
try to connect on ports used by webmails, cPanel and such.
I think the user should still have the choice.
G.
_______________________________________________
support-seamonkey mailing list
[email protected]
https://lists.mozilla.org/listinfo/support-seamonkey
