Lavabit SSL Cert Revoked

Re:Lavabit SSL Cert Revoked by bcoates on Tuesday October 08, 2013 @05:37PM (#6518001)

If the connection was using a forward-secret key exchange (like DHE or ECDHE), then no. Unfortunately it's common not to and browsers don't do anything to warn people that they're using a low-security mode.

[ Parent | on HN ]

Re:Lavabit SSL Cert Revoked by Amadou on Tuesday October 08, 2013 @05:45PM (#6518043)

FWIW, just now I went looking for a firefox plugin that reports (in a human-friendly way) whether or not the SSL connection for a page is using perfect forward secrecy (PFS).

I found "Calomel SSL Validation," which I am about to install. The PFS reporting only works with Firefox 25 and up.

https://addons.mozilla.org/en-US/firefox/addon/calomel-ssl-v...

[ Parent | on HN ]

Re:Lavabit SSL Cert Revoked by davidism on Tuesday October 08, 2013 @11:31PM (#6519254)

Thanks for finding this. Calomel's website [1] gives much more information about how the scoring is done as well as security in general; very interesting.

[1] https://calomel.org/firefox_ssl_validation.html

[ Parent | on HN ]

Re:Lavabit SSL Cert Revoked by mstrem on Tuesday October 08, 2013 @10:15PM (#6519071)

Also the Netcraft Extension gives you this information: http://news.netcraft.com/archives/2013/09/06/perfect-forward...

[ Parent | on HN ]

Re:Lavabit SSL Cert Revoked by sdfjkl on Wednesday October 09, 2013 @09:08AM (#6520979)

Sadly it comes with an awful toolbar.

[ Parent | on HN ]