Issue metadata
Sign in to add a comment
|
Trim website_settings.cc logic and never show SSL 3.0. |
||||||||||||||||||||||||
Issue descriptionThis is a follow-up to https://codereview.chromium.org/2382983002/. There is some logic in website_settings.cc to: 1. Show the renegotiation_info extension. 2. Downgrade the security status if we have an SSL 3.0 host (but only on top-level loads). (1) was probably added back when the renegotiation bug was first found. Trying to enforce it isn't really a priority (it's largely for servers to enforce, not client), so let's just take it out completely. (2) was originally added when we needed to drop SSL 3.0 for POODLE. It should be a no-op because SSL 3.0 is long gone, but it's reachable if we load an ancient cached SSL 3.0 resource without revalidation. Such resources will also appear in the security panel as SSL 3.0, which is pretty confusing. SSL 3.0 is long gone, so I propose we drop those cache entries. This will prevent the security panel from showing SSL 3.0 and mean make removing that website_settings.cc check actually a no-op. https://chromium.googlesource.com/chromium/src/+/master/chrome/browser/ui/website_settings/website_settings.cc#637 Note that dropping those cache entries is not much of a security guarantee because we don't do provenance tracking for complex loads like revalidations or range requests, and doing so is probably unreasonable. See https://groups.google.com/a/chromium.org/d/msg/security-dev/pdvsbRGnKgA/kzhhvnERqGoJ The motivation is mostly so UI will never show SSL 3.0.
,
Oct 11 2016
,
Oct 18 2016
Assigning to davidben@ on the assumption he meant to do so, but feel free to reassign as needed.
,
Oct 19 2016
,
Oct 20 2016
,
Nov 16 2016
,
Nov 24 2016
,
Jun 7 2017
,
Jun 7 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3bd7dd5df8fae5704a56611364b34a1c0a17dabd commit 3bd7dd5df8fae5704a56611364b34a1c0a17dabd Author: estark <estark@chromium.org> Date: Wed Jun 07 19:42:38 2017 Drop SSLv3 cache entries SSLv3 is gone so we no longer need to load cache entries. Doing so allows us to remove SSLv3 logic from UI surfaces, as I've done for Page Info in this CL. BUG= 652505 Review-Url: https://codereview.chromium.org/2923403002 Cr-Commit-Position: refs/heads/master@{#477730} [modify] https://crrev.com/3bd7dd5df8fae5704a56611364b34a1c0a17dabd/chrome/browser/ui/page_info/page_info.cc [modify] https://crrev.com/3bd7dd5df8fae5704a56611364b34a1c0a17dabd/net/http/http_response_info.cc [modify] https://crrev.com/3bd7dd5df8fae5704a56611364b34a1c0a17dabd/net/http/http_response_info_unittest.cc
,
Jun 7 2017
Above commit takes care of SSLv3, looks like renegotiation was removed at some point already. |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by f...@chromium.org
, Oct 6 2016