269049 - secure pages at amazon only spawns alert:: "Mozilla and www.amazon.co.uk cannot communicate because they have no common encryption algorithms"

Status: VERIFIED EXPIRED

(Core Graveyard :: Security: UI, defect)

Description

[R.K.Aa.]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a5) Gecko/20041106

trying to use secure pages at amazon.co.uk (to login etc) - i only get an alert
 the page does  not load untill i delete all amazon-related cookies. (which
appearanly also include some cookie/s not containing the name "amazon" it seems
- deleting only the "amazon" cookies isn't enough)

After deleting all cookies i can operate there out the day, it seems. Next day
it will fail again.

I have an account there where i log in and out. I've seen this bug only after
having logged out, but it all worked flawlessly some months ago when i used it
last, if I've allowed cookies.

to repro:
log in to an account
log out
wait a day
try to access any secure page there (for instance this link:
https://www.amazon.co.uk/exec/obidos/flex-sign-in/ref=ya_hp_pay_4/202-3711191-2466209?opt=a&page=help/ya-sign-in-secure.html&response=select-preferred-currency&method=GET
which is the "Currency converter" link on their front page.

Result:
Alert saying "Mozilla and www.amazon.co.uk cannot communicate because they have
no common encryption algorithms"

Comment 1

[OstGote!]

same thing with Bug 268249, Bug 265419

Does the workaround from Bug 265419 help?

Comment 2

[R.K.Aa.]

To comment 1:
Yes, if I open preferences and check "go to Use OSCP to validate only
certificates that specify an OCSP service URL" under "Privacy and Security" ->
"Validations" - I can access the pages again.

Or - alternatively - i delete the session cookies etc, and it will also work.
So.. did security code change somewhere recently, or is this a cookie-bug?

Comment 3

[Dan Everton]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

I am also seeing this with Firefox 1.0 on amazon.co.uk. Clearing the session
cookie does stop the problem for a while but then it comes back.

Comment 4

[R.K.Aa.]

changing component to "networking cookies", regression keyword.

What changed? I browsed the relevant 2 day periode checkins indicated in firefox
bug 265419 (bonsai, "all files in the repository") - but couldn't figure out
what caused the regression.

Comment 5

[Michiel van Leeuwen (email: mvl+moz@)]

cookies backend did not change.
This looks more like a site bug.

Comment 6

[James Ross]

I know someone who ran into this error with Firefox 1.0, and it was fixed by
ticking "Use TLS 1.0" in Tools > Options > Advanced > Security. It was ok with
the previous version, unfortunately I don't know if that was 1.0PR or 0.9.x, but
I don't believe it was either RC version.

Comment 7

[Gervase Markham [:gerv]]

This is an automated message, with ID "auto-resolve01".

This bug has had no comments for a long time. Statistically, we have found that
bug reports that have not been confirmed by a second user after three months are
highly unlikely to be the source of a fix to the code.

While your input is very important to us, our resources are limited and so we
are asking for your help in focussing our efforts. If you can still reproduce
this problem in the latest version of the product (see below for how to obtain a
copy) or, for feature requests, if it's not present in the latest version and
you still believe we should implement it, please visit the URL of this bug
(given at the top of this mail) and add a comment to that effect, giving more
reproduction information if you have it.

If it is not a problem any longer, you need take no action. If this bug is not
changed in any way in the next two weeks, it will be automatically resolved.
Thank you for your help in this matter.

The latest beta releases can be obtained from:
Firefox:     http://www.mozilla.org/projects/firefox/
Thunderbird: http://www.mozilla.org/products/thunderbird/releases/1.5beta1.html
Seamonkey:   http://www.mozilla.org/projects/seamonkey/

Comment 8

[Gervase Markham [:gerv]]

This bug has been automatically resolved after a period of inactivity (see above
comment). If anyone thinks this is incorrect, they should feel free to reopen it.