Hacker News Reader

Comment by nodesocket | Hacker News Reader

       ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS";

Which results in perfect forward secrecy and an A+ rating in SSL Labs.

View on HN

Which means you shouldn't trust that A+ single metric without actually looking at the browser list or testing it yourself. I just opened your site on Debian unstable with latest Iceweasel/Firefox 24.5.0, and I get connected via RC4.

Arguably thats also NSS's fault for implementing TLS1.2 so late, but still...

My site only gets an "A" rating, but Firefox actually connects using ECDHE-RSA-AES256-SHA. I use this cipherlist

  HIGH:!SSLv2:!aNULL:!3DES

Which one is more secure?

The difference between A and A+ is in Strict-Transport-Security HTTP header.

Is that the same as Ivan Ristic's recommendation at https://community.qualys.com/blogs/securitylabs/2013/08/05/c...

Reply on news.ycombinator.com