1160122 - https://saml.yammer.com uses RC4 cipher suites (which are deprecated and insecure), and is RC4 only on Firefox

Status: RESOLVED FIXED

(Web Compatibility :: Site Reports, defect)

Description

[Carsten Book [:Tomcat]]

Steps to reproduce:

Use Nightly: 

login to yammer https://www.yammer.com/mozilla.com/
--> Secure Connection Failed

The connection to saml.yammer.com was interrupted while the page was loading.

    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

What version of Firefox are you using?

Comment 2

[Ludovic Hirlimann [:Usul]]

(In reply to David Keeler [:keeler] (use needinfo?) from comment #1)
> What version of Firefox are you using?

40.0a1 (2015-04-30)

Comment 3

[Al Billings [:abillings - ex-MoCo]]

Same with the 4/30/2015 daily build of Aurora as well.

Comment 4

[:Cykesiopka]

I don't know if there's some difference visiting https://www.yammer.com/mozilla.com over an internal Mozilla network or not, but I get redirected to https://saml.yammer.com , which appears to be the problematic domain.

https://www.ssllabs.com/ssltest/analyze.html?d=saml.yammer.com :
> Cipher Suites (sorted by strength; the server has no preference)
> TLS_RSA_WITH_RC4_128_MD5 (0x4)
> TLS_RSA_WITH_RC4_128_SHA (0x5)
> TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011)
> TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c)
> TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)

RC4 is of course on whitelist mode, and assuming the SSL Labs Client Test is correct, none of the non-RC4 cipher suites are supported.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler]]

This is a tech evangelism issue. Presumably we have contacts at Yammer?

Comment 7

[Dave Garrett]

Note that there are two issues here:
1) The server does not support a cipher that can be used with Firefox.
2) The server does not respond with an error such that Firefox reports ssl_error_no_cypher_overlap.

Ideally, Firefox would like to use:
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
At minimum:
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)

The combination of CBC+SHA256 is not supported. Either upgrade to GCM or stick with SHA1.

Comment 8

[Daniel Holbert [:dholbert]]

(adding workaround to whiteboard, for anyone who's actually being blocked from logging into yammer by this bug.)

Comment 9

[:Atoll]

cc'ing the SSO team, since they may have contacts at Yammer that are helpful here.

Comment 10

[Justin Dow [:jabba]]

cc'ing vdoan, as he might have contacts at Yammer that are helpful here.

Comment 12

[Vien Doan [:vdoan]]

I will reach out to Yammer to get assistance on this.

Comment 13

[Jed Davis [:jld] ⟨⏰|UTC-8⟩ ⟦he/him⟧]

(In reply to Dave Garrett from comment #7)
> Ideally, Firefox would like to use:
> TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
> At minimum:
> TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
> 
> The combination of CBC+SHA256 is not supported. Either upgrade to GCM or
> stick with SHA1.

Is there a reason that combination isn't supported?  It seems bad to be pressuring server operators to stay with a weaker hash function just because they can't also change their cipher mode.

Comment 14

[Dana Keeler (she/her) (use needinfo) [:keeler]]

(In reply to Jed Davis [:jld] {UTC-7} from comment #13)
> (In reply to Dave Garrett from comment #7)
> > Ideally, Firefox would like to use:
> > TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
> > At minimum:
> > TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
> > 
> > The combination of CBC+SHA256 is not supported. Either upgrade to GCM or
> > stick with SHA1.
> 
> Is there a reason that combination isn't supported?  It seems bad to be
> pressuring server operators to stay with a weaker hash function just because
> they can't also change their cipher mode.

There's a rationale for this in https://briansmith.org/browser-ciphersuites-01.html (see the last paragraph of the "Minimize the number of ciphersuites offered" section and the "Be compatible with web servers and with other browsers" section). Basically, it wasn't deemed necessary to add another (new in TLS 1.2) RSA ciphersuite given that we're trying to deprecate them anyway.

Comment 15

[Dave Garrett]

At this point, we seem to want to avoid adding new known-weak cipher suites so as to discourage sites from upgrading to old ones that we're also trying to get people to replace. That means suites without AEAD, FS, or SHA2 (or newer) are not likely to be added.

In this case, the server supports TLS 1.2, so it really should just use GCM.

Comment 16

[Randell Jesup [:jesup] (needinfo me)]

Any word if they're going to fix this?

Comment 17

[Vien Doan [:vdoan]]

No word back from them yet. The support engineer who was originally assigned the ticket said she has reached out to their senior engineers for help. I will update again once I hear more.

Comment 18

[Yuhong Bao]

Fixed, probably when they moved it to MS's datacenters.