1092836 - Warn about TLS 1.0 usage

Status: RESOLVED INACTIVE

(DevTools :: Console, defect)

Description

[Anne (:annevk)]

Given how much of a mess it is to remove SSLv3, we should start early with TLSv10.

Comment 1

[Richard Barnes [:rbarnes]]

This needs to be aligned with our existing server guidance, which recommends TLSv1.0 support in the Intermediate configuration.

https://wiki.mozilla.org/Security/Server_Side_TLS

Comment 2

[Johannes Pfrang [:johnp]]

TLSv1.0 support =/= TLSv1.0 negotiation.

I'd think it's still reasonable for the server guidance to recommend support of TLSv1.0 in the intermediate configuration, but each of those guideline also recommends support for higher protocol versions which will be negotiated using a modern browser and therefore not trigger a warning.

I'm not even sure we can detect a server supporting TLSv1.0 while connecting using TLSv1.2 (at least that's what I read...)

Comment 3

[Johannes Pfrang [:johnp]]

Attachment: WIP - Warn about TLS 1.0 usage in console

This is pretty much the same as bug 1092835, I just reused the same code after it got removed for SSL3 in bug 1106470 and updated it for TLS 1.0. No tests included, because I don't know how to add a TLS 1.0 host to mochitest. Also, feel free to grab this as I'm not sure when I'll get time to add the tests.

Comment 4

[Johannes Pfrang [:johnp]]

Attachment: bug1092836.diff

Fixed patch format.

Comment 5

[Johannes Pfrang [:johnp]]

Attachment: WIP - Warn about TLS 1.0 usage in console

Comment 6

[Masatoshi Kimura [:emk]]

I don't think it is a viable approach to spam Web Console in half of the Internet. It will be rapidly ignored and more important warnings (e.g. use of RC4) will be buried in the spam.

Comment 7

[sjw]

Google has recently announced to deprecate TLS 1.0/1.1 in Chromium.
Could we please reopen this? Or is this tracked somewhere else?

Comment 8

[Nicolas Chevobbe [:nchevobbe]]

(In reply to sjw from comment #7)

Google has recently announced to deprecate TLS 1.0/1.1 in Chromium.
Could we please reopen this? Or is this tracked somewhere else?

I think Bug 1512505 covers this.