Security Spy Web Server SSL
I just noticed that with the upgrade to the latest Firefox browser (50.1.0), all of the weak cipher (RC4, etc) support has been removed from the browser. This also means that SS no longer works with Firefox as it presents back weak ciphers at the crypto negotiation. Just wondering if Ben is aware, and when we can harden up the server to deprecate these weak ciphers?
Comments
-
The cipher set used for a connection is determined by a negotiation between client and server. The connection should only fail if there are no common ciphers supported by both. SecuritySpy has two options (under Preferences -> Web that control which ciphers are to be made available to clients, as follows:
Require clients to use TLS version 1.2 or later
This requires that HTTPS web clients use the latest and most secure version of TLS (the cryptographic protocol underlying HTTPS). Leave this option enabled unless you need the web server to be accessible to to older clients that don't support TLS 1.2. Note that macOS system versions before 10.9 do not support TLS 1.2, so most software running on these systems will not be able to connect to the server if this option is enabled.
Disable cyphers that use insecure protocols
There are a variety of different cryptographic protocols that can be used for an HTTPS connection; these are negotiated between the client and server whenever a new connection is made. Many older protocols (such as RC4, MD5 and DES) have been found to have security flaws, and therefore should be avoided if possible. Enabling this option ensures that these insecure protocols will not be used, however this may prevent older clients from being able to connect to the web server.
These options are available in the latest version of SecuritySpy. If you don't see these options, you must be using an old version of SecuritySpy.
Hope this helps. -
Thanks Ben. I really should RTFM next time. I thought I had done this (and installed the latest software). Thanks for the response.
-
Firefox 50.0.1 on OS X 10.9.5 is failing against SSPy 4.1b5.
I have both the "Require clients.." and the "Disable cyphers..." options set.
Fox says:
"An error occurred during a connection to oldmini.local:8001. Cannot communicate securely with peer: no common encryption algorithm(s). Error code: SSL_ERROR_NO_CYPHER_OVERLAP"
is this because I'm running on 10.9.5? or something about the beta? -
Just tested two more macs against this beta.
One 10.9.5 / FFox50, another 10.12.2/FFox48
same result. same result upgrading to b7
