New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 883670 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Nov 9
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Ssl-version-min Broken, Add flag to enforce Minimum TLS, Cipher Selection & Priority, and Disabling Session Tickets

Reported by canyonco...@gmail.com, Sep 13

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0

Steps to reproduce the problem:
1. Have too many command line switches in Chrome shortcut target to add --ssl-version-min=
2. Open chrome in new incognito window from task-bar 
3. Open chrome from a link in third party application

What is the expected behavior?
Chrome Minimum TLS enforced system wide 

What went wrong?
ssl-version-min broken! Min Tls can only be enforced from a shortcut and is broken if you load a link from a third party application like Thunderbird or Outlook express. This is unacceptable for user security.

Did this work before? N/A 

Chrome version: 71.0.3551.0  Channel: stable
OS Version: Windows 7 x64 SP1
Flash Version: none

Depreciated ciphers and TLS session tickets are the weakest link in the TLS chain. Disabling them is critical to ensure safe and secure browsing. Command line switches are limited to a max of 269 bytes in windows. This is totally unacceptable, and forces users to compromise on security and preferences, and unnecessary and time wasting efforts, like loading chromium from command prompt. On top of that, these switches are not executed when loading web links outside the command line. This is completely illogical. 

Solution: Add Min TLS, Cipher Selection & Priority, and option to disable TLS session tickets in chrome://flags/ & even better, under privacy & security settings. This will also encourage users become more educated in security critical TLS functionality. 

Read more: https://blog.filippo.io/we-need-to-talk-about-session-tickets/

Thanks!
 
Furthermore, there is no option, switch, or flag to disable tls session tickets in Chromium. Disabling session tickets is common practice and functionality in windows, .net, firefox and other software. Please include a flag & settings preference to disable this.
Furthermore it does appear ssl-version-min is broken, with the commandline flag enabled, see attached photo.
broken.png
47.5 KB View Download
Components: Internals>Network>SSL
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug
Cc: svaldez@chromium.org
To verify, you are using "--ssl-version-min=tls1.2" for the SSLLabs Client test?

If you'd like to globally set the minimum SSL/TLS version, you can use the SSLVersionMin admin policy on Windows (https://www.chromium.org/administrators/policy-list-3#SSLVersionMin).


Chrome does not even have code for SSL 3.0 anymore, so either there is an issue with the SSL Labs test or you are behind some kind of TLS-terminating middlebox. As requested on the other bug, please attach a NetLog per these instructions:

https://dev.chromium.org/for-testers/providing-network-details
Labels: Needs-Feedback
ssl-version-min was not broken, a necessary js was blocked by umatrix! 
Project Member

Comment 8 by sheriffbot@chromium.org, Sep 13

Cc: davidben@chromium.org
Labels: -Needs-Feedback
Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: Needs-Triage-M71
Labels: Triaged-ET TE-NeedsTriageHelp
The issue seems to be out of TE-scope as it is related to ssl-version-min and Cipher Selection and already the issue is being investigated by dev team. Hence, adding label TE-NeedsTriageHelp in order to push this issue out of TE-triaging bucket.

Thanks...!!
Status: WontFix (was: Unconfirmed)
Sounds like, per comment #7, this was resolved. Closing.

Sign in to add a comment