search

sibiantony / ssleuth

A firefox add-on to rate the quality of HTTPS connections
GNU General Public License v3.0
108 stars 14 forks source link

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 cipher suite inconsistent scoring #28

Open warp16 opened 9 years ago

warp16 commented 9 years ago

Excellent add-on, found one problem, this one cipher suite is scored 9.0 on some sites (example weakdh.org) and 10.0 on others (example usaa.com.) Is there a difference I'm not seeing?

2015-05-27 17_06_25-

2015-05-27 17_22_14-

warp16 commented 9 years ago

I think it might be because the first site doesn't have an EV cert, but shouldn't that affect only the primary site score and not the score of the individual cipher suites?

welwood08 commented 9 years ago

I've not been using this addon long, but as I understand it the scores shown in the images above relate to the bold domain's overall score and just happen to be positioned near to the cipher suite the domain uses.

warp16 commented 9 years ago

That would explain it. In that case, perhaps that score should be moved to the left of the domain name instead of the cipher suite, and a separate score added specifically to reflect the quality of the cipher suite in use.

sibiantony commented 9 years ago

@welwood08 is right. The scores are the overall ratings, and not just for the ciphersuite. The ratings also include EV-cert, Firefox connection status etc (which is inherited from the top domain). You can find some details here : https://github.com/sibiantony/ssleuth/wiki/Domain-Requests In future, I hope to remove EV-cert rating/connection status rating for calculating this score.

warp16 commented 9 years ago

Thanks for the clarification.

bickelj commented 8 years ago

Since firefox already gives great feedback on Bad connection or on an invalid certificate, I have found these settings to work great and provide the type of discrimination I'm looking for: Cipher suite: 1.0 Forward secrecy: 1.0 Extended validation: 0.0 Connection status: 0.0 Certificate state: 0.0 Signature algorithm: 1.0

Also, leaving the Cipher suite scoring at defaults.

If you visit a site with no forward secrecy, you will notice. If you visit a site with non-sha2 certificate, you will notice.