Issue metadata
Sign in to add a comment
|
Several weak cipher suites still in Google Chrome browser Version 65.0.3325.181 (Official Build) (64-bit)
Reported by
markrijc...@gmail.com,
Sep 25
|
||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36 Steps to reproduce the problem: 1. Visit https://www.ssllabs.com/ssltest/viewMyClient.html 2. View list of weak ciphers supported by Google Chrome What is the expected behavior? 1. Visit https://www.ssllabs.com/ssltest/viewMyClient.html 2. Only see strong ciphers supported by Google Chrome (including forward secrecy and not using SHA-1) What went wrong? 1. Visit https://www.ssllabs.com/ssltest/viewMyClient.html 2. View list of weak ciphers supported by Google Chrome Did this work before? N/A Chrome version: 65.0.3325.181 Channel: n/a OS Version: Debian GNU/Linux 9.5 (stretch) Flash Version: Unknown It would also be great to add the possible to manually disable TLS 1.0, TLS 1.1, etc... via chrome://flags/ I only see TLS 1.3 in chrome://flags/
,
Sep 25
Generally, we're very careful with these sorts of removals because they can make sites inaccessible in all sorts of bad ways. Deprecating a cipher is a careful consideration of its usage and utility against any security issues. +some network folks for more comment on this.
,
Sep 25
Note the current Chrome Stable is 69, so you likely want to update. As dominick mentioned, the choice of deprecations are carefully balanced against the risk to users versus the compatibility risk, in line with https://www.chromium.org/blink/removing-features and consistent with https://www.chromium.org/blink#new-features ) You can disable ciphersuites and TLS versions via the command-line. There are no plans to expose this chrome://flags, which is intended only for temporary usage. --ssl-version-min (which takes a value of "tls1", "tls1.1", "tls1.2", or "tls1.3") --cipher-suite-blacklist (which takes a comma-separated list of hexadecimal ciphersuites from https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4 - e.g. "--cipher-suite-blacklist=0x0004,0x0005") Marking WontFix, as the requested functionality is present as far as we'll extend support for it. The Cipher Suite Blacklist is intentionally not exposed via Enterprise Policy, but SSLVersionMin is exposed ( https://www.chromium.org/administrators/policy-list-3 ). |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by markrijc...@gmail.com
, Sep 25