279809 - aetna.com - The browser you are currently using does not meet our 128-bit encryption requirement.

Status: RESOLVED FIXED

(Tech Evangelism Graveyard :: English US, defect)

Description

[Mike Alterman]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

I started using Firefox 1.0 during 11/2004 and was able to login to my
information  until last week (2005-01-18) when I received the following msg:

"Software and Security Requirements

We're sorry.  The browser you are currently using does not meet our 128-bit
encryption requirement.

To access Aetna Navigator™, your browser must use 128-bit encryption.  Should
you need to upgrade your browser, the link to Netscape provided below is for
your use in downloading a 128-bit encryption upgrade.  Aetna is not responsible
for and does not endorse the content and browser update process provided by this
website.

What is Encryption?
    Encryption scrambles data into unintelligible characters based on a secret
key.  Encryption increases the level of security for the information you send
from your browser over the Internet to the Aetna Navigator site.  Most browsers
support a minimum level of 40-bit encryption, as well as a stronger 128-bit
encryption level.

    The Aetna Navigator site only supports 128-bit web browser encryption.  Even
though we use the more secure 128-bit encryption, there is a certain amount of
risk involved in any Internet communication, and Aetna cannot guarantee the
privacy and confidentiality of information exchanged in this manner.

    Understanding this, if you would prefer to contact us by phone, you can call
Member Services at the number on your ID card.  If you do not have an ID card
yet, please contact your employer/group benefits office to obtain the toll-free
number.
How can you upgrade your browser to 128-bit encryption?
    The link to Netscape provided below can be used to download a 128-bit
encryption upgrade.
     
    Netscape Communicator link:
    http://home.netscape.com/download Please note:  For Netscape users, Aetna
Navigator is best viewed using Netscape Version 4.75 - 4.77.  Use of Netscape
Version 6.0 is not recommended as it may result in the inability to access and
view some of the features and functions offered on Aetna Navigator, e.g. access
problems with registration, inability to access electronic explanation of
benefits statement.
     
Are there any other technical requirements for using Aetna Navigator?

        * Your browser must be configured to enable cookies (this is the default
setting for version 4.0 or higher browsers).  If you would like additional
information on how we use cookies, please refer to our privacy statement.
        * Your browser must be configured to enable JavaScript (this is the
default setting for version 4.0 or higher browsers).
        * Your screen resolution should be set to 800 x 600 pixels (this is
optional, but recommended).

If you require technical assistance, please call 1-800-225-3375
Monday through Friday 7:00 a.m. to 9:00 p.m. Eastern Time."

I called customer support and tried to explain that Firefox dous support 128 bit
encryption. I can log into my bank, stock broker, credit cards and other secure
web sites. The person I was talking with seemed to think I am lying.

I left a msg for the superviser - no call back yet.

Also posted a msg at www.aetna.com - the page has been removed.
 I suggested that Aetna contact Mozilla.org about this encrytion issue.

Reproducible: Always

Steps to Reproduce:
1.visit web site
2.
3.

Actual Results:  
Software and Security Requirements

We're sorry.  The browser you are currently using does not meet our 128-bit
encryption requirement. 

Expected Results:  
I should have received a login page

Comment 1

[Felix Miata]

Conforming summary to TFM item 10 at 
http://www.mozilla.org/projects/tech-evangelism/site/procedures.html#file-new

Reporter, when you file a TE bug, please follow the reporting guidelines.

Comment 2

[Daniel Veditz [:dveditz]]

(In reply to comment #1)
> Reporter, when you file a TE bug, please follow the reporting guidelines.

TE person, when you have guidelines put a link somewhere folks have a prayer of
finding while reporting a bug. There's a "more info" link on the components page
(that most will probably miss), but even people who diligently follow it to
http://www.mozilla.org/projects/tech-evangelism/ will find no clue of any bug
reporting guidelines.

Anyway, confirming. The initially reported URL
(https://member.aetna.com/Member_Public/index.html) seems to work again, it
redirects to https://www.aetna.com/member/ with a login page.
https://member.aetna.com works too. But http://member.aetna.com/ redirects to
http://member.aetna.com/member_registration/encrypt_err_real.html as described.


it's trying to redirect you to you seem to bypass the initial bogus rejection
and get a login page. Can't see if it works past that point without an account.

Comment 3

[Daniel Veditz [:dveditz]]

Actually http(s)://member.aetna.com/ sometimes works, sometimes doesn't. Maybe
they have different software running on different servers? So far, though, going
directly to https://www.aetna.com/member/ has never failed for me.

Comment 4

[Felix Miata]

> TE person, when you have guidelines put a link somewhere folks have a prayer of
> finding while reporting a bug.

The only link I provided in comment 1 takes me to "Filing New Site Evangelism
Bugs", exactly as I intended it to do for anyone else. I don't understand your
problem.

Comment 5

[Mike Alterman]

I sent the following letter - have not received a response but I no longer have
this problem.


							Michael Alterman
							8 Birch Lane
						        East Windsor, NJ  08520
							609-371-0755
							[e-mail]

2005-02-10

Dr. Wei-Tih Cheng, CIO
Aetna, Inc.
151 Farmington Ave.
Hartford, CT  06156

860-273-0123


Dear Dr. Cheng;

I became a member of Aetna Healthcare on 2004-10-01 and set up a web account
using Netscape 7.2. During 2004-11, I switched to Mozilla Firefox 1.0 and
accessed my medical information without a problem.

During 2005-01, I began experiencing a problem with site access and tried to
discuss the issue with technical support.

I was told that Firefox does not use 128-bit encryption. I tried to explain that
it previously worked with the site and it works with web sites for my bank, my
stockbroker and two (2) credit cards and was basically accused of lying. I also
left a message for a supervisor that was not returned.

I find the behavior of the Aetna web site to be inconsistent.  At various times
I receive a message that I am not using a browser that uses 128-bit encryption.
This can occur when I click on the bookmarked link for the log in page, after
entering my log in and submitting it, while moving around the site, or when I
log out. Enclosed is a copy of the message.

The links I bookmarked are:
https://www.aetna.com/member/
	https://member.aetna.com/Member_Public/index.html

My browser is configured for session cookies.

Do you and Aetna support open standards for the Internet?
 Should you have any questions about Mozilla, please visit   www.mozilla.org

Please contact me to resolve this issue. The preferred contact method is email -
[e-mail].

Thank you for your anticipated assistance,


Michael Alterman