TLS handshake that kills Chrome

Re:TLS handshake that kills Chrome by egeozcan on Tuesday March 04, 2014 @09:34AM (#7340349)

Maybe put a warning (something in the title) which tells that opening the page may cause our browser to crash? I thought it would open a page where the issue is discussed, not a page which directly crashes my browser. (HN hides the subdomain: demo.cmrg.net, therefore removing the only indicator showing that this is a demo)

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by gmac on Tuesday March 04, 2014 @09:19AM (#7340265)

This does indeed kill Chrome (v33 on OS X 10.9.2). Firefox copes fine, with the error message ssl_error_weak_server_ephemeral_dh_key.

Anyone know what's going on here?

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by chimeracoder on Tuesday March 04, 2014 @09:40AM (#7340392)

Tried it out from the console using Chromium on Linux. It's a segfault of some form, though it unfortunately doesn't log anything else to the terminal before segfaulting.

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by robk on Tuesday March 04, 2014 @09:40AM (#7340391)

That's quite annoying. It doesn't indicate that clicking this link kills Chrome rather than a disclosure piece about something that could kill Chrome. I'd be even more annoyed if this crashed and lost unsaved work.

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by mekishizufu on Tuesday March 04, 2014 @09:44AM (#7340410)

The corresponding bug report: https://code.google.com/p/chromium/issues/detail?id=348987

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by just_reading on Tuesday March 04, 2014 @09:54AM (#7340495)

Does not kill Chrome Version 27.0.1453.110 on Redhat 6.4

Instead says:

"Server has a weak ephemeral Diffie-Hellman public key This error can occur when connecting to a secure (HTTPS) server. It means that the server is trying to set up a secure connection but, due to a disastrous misconfiguration, the connection wouldn't be secure at all!

In this case the server needs to be fixed. Google Chrome won't use insecure connections in order to protect your privacy."

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by th0br0 on Tuesday March 04, 2014 @09:32AM (#7340338)

http://www.openwall.com/lists/oss-security/2014/03/04/8

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by sp8 on Tuesday March 04, 2014 @09:32AM (#7340337)

I'm sure there's a perfectly good reason why I clicked on a link that told me it would kill my browser...

Yes, killed Chrome 33.0.1750.146 m on Win7 here.

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by jcampbell1 on Tuesday March 04, 2014 @09:53AM (#7340480)

Wouldn't this potentially be eligible for an security award, and disclosing it this way negates that award?

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by randall on Tuesday March 04, 2014 @09:37AM (#7340375)

Haha! Is there an actual link explaining the issue, not just the source? That's a fun demo.

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by kentuckyduck on Tuesday March 04, 2014 @09:44AM (#7340408)

Killed Google Chrome release 35.0.1862.2 Ubuntu unstable package too

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by cl8ton on Tuesday March 04, 2014 @09:22AM (#7340275)

Kills it on Windows 8 also. Chrome Version 33.0.1750.146 m

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by vaadu on Tuesday March 04, 2014 @09:54AM (#7340501)

Did not kill chromium based epic browser.

[ Parent | on HN ]

Re:TLS handshake that kills Chrome by qKyuu on Tuesday March 04, 2014 @09:50AM (#7340462)

That is very irresponsible.

Don't submit a direct link that crashes the whole browsers instead post a communication explaining the risks (also stop upvoting this!). It is also irresponsible since Google has a well publicized framework that enables responsible disclosure that this should have gone through first.

[ Parent | on HN ]