News for hackers. Stuff that matters.

A comment on OpenSSL Security Advisory. Parent comment

Re:OpenSSL Security Advisory by takeda on Thursday June 11, 2015 @06:45PM (#9702945)
38.0.5 is safe. I learned it myself when trying to use internal service.

    Secure Connection Failed

    An error occurred during a connection to 10.xx.yy.xx. SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message. (Error code: ssl_error_weak_server_ephemeral_dh_key)

        - The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
        - Please contact the website owners to inform them of this problem.
I wish they gave option to bypass it.
[ Parent | on HN ]
Re:OpenSSL Security Advisory by MBlume on Thursday June 11, 2015 @06:54PM (#9702985)
I'm running 38.0.5, the weakdh page says I'm vulnerable
[ Parent | on HN ]
Re:OpenSSL Security Advisory by what_the_diffie on Thursday June 11, 2015 @07:50PM (#9703173)
It's hard to tell from the paper, because they don't include either specific build version numbers of browsers / servers nor date of publication, so their results are difficult (e.g., impossible) to reproduce exactly.

0: https://weakdh.org/imperfect-forward-secrecy.pdf

[ Parent | on HN ]
Re:OpenSSL Security Advisory by takeda on Friday June 12, 2015 @12:57PM (#9707093)
Interesting, weakdh says I'm safe...

Both on Mac and OpenSuSE.

[ Parent | on HN ]