Hacker News Reader

Comment by atYevP | Hacker News Reader

We got a B! That's above average! Totally not "terrible". Truth is the website and the service itself are fairly different, but I can tell you that we have a lot of folks using, lets say..."older", browsers that access our site, and so we try to make sure that they can still access their accounts - though we're constantly monitoring for ways to make it better. A lot of folks that use us have older operating systems and that hampers us a bit.

View on HN

Even though it stops folks with updated browsers from accessing your site?

http://i.imgur.com/3GCKrzr.png

Brian from Backblaze here. Which browser was that? We often test with Mac/Windows and Safari/Chrome/IE/Netscape/Opera, etc. It all seems to work here. Did you tweak any browser settings or are you running stock?

FYI, 3DES should be still be enabled by default in browsers for a while, but I am not surprised if at some point they will get rid of it too.

Unable to Connect Securely

Firefox cannot guarantee the safety of your data on www.backblaze.com because it uses SSLv3, a broken security protocol. Advanced info: ssl_error_no_cypher_overlap

Firefox 35, rc4 disabled

As far as I understood you should not (especially not only) use rc4. https://en.wikipedia.org/wiki/RC4 even cloudflare is trying to get used of rc4. https://blog.cloudflare.com/killing-rc4/

> Fast-forward to 2013 and attacks on RC4 have been demonstrated; that makes the preference for RC4 problematic.

Looks like they killed 3DES, leaving only RC4.

Firefox Nightly. Oddly enough, the page loads fine on my laptop with the same browser. I'll diff my configs and see if anything interesting shows up.

This is a pretty weak excuse, are you claiming adding modern crypto support would make old browsers not work on your site?

If you look at the ssllabs analysis, they already fail in IE 6 handshake simulation. Offhand I can't say if support for older browser is incompatible with more modern ciphers and protocols.

Brian from Backblaze here. Why do we get a bad grade for not talking with IE6? I'm honestly curious... I thought anybody who supported IE6 should be downgraded, because IE6 was end of lifed, inherently using it is a bad bad bad thing. It is literally safer to not use it than use it, right?

I don't think it's even possible to run IE6 on Windows Vista or Windows 7 or Windows 8, but I'm not entirely sure of that.

Yea, that is a false claim and not what OP means.

The mozilla wikipage on TLS configuration has good information on ciphersuites and supported browser: https://news.ycombinator.com/item?id=9000235

The intermediate suite (default) says: "Firefox 1, Chrome 1, IE 7, Opera 5 and Safari 1. " The "Old backward compatibility" has IE6, but it also has SSL3, which is really not recommended.

It should not be incompatible. Servers will just select 3DES or RC4 suites for older browsers that only have these listed.

Instead of patting yourself on the back based on your interpretation of an arbitrary letter grade, can you please do some research into the problems flagged by ssllabs and fix them? Supporting older browsers does not preclude supporting modern ciphersuites and TLS versions for new browsers.

Brian from Backblaze here. We are aware of the sslabs flagged issues and we're working to keep on top of it. Sometimes these issues apply to Backblaze and we are vulnerable for a short time (like when HeartBleed came out we had to scramble to plug it as fast as humanly possible). But most of the time when we are slightly slow it is because it doesn't REALLY affect our customers or us.

Keep checking back, I swear you will see improvement over the next week.

I don't think there are any acute issues like heartbleed (other than the possibility that RC4 is completely broken to secure against state-level adversaries, or that your ssl key might be compromised now or in the future), but the downvoted-to-hell points made higher up are that you should have been aware enough of best practices to improve your ssl config a long time ago.

It doesn't inspire confidence that you're still working at enabling TLS 1.2 or some AES ciphersuites with PFS. ... and at de-prioritizing RC4 if you need to keep it enabled. (A competitor, crashplan, seems to think 3DES is enough to support older clients; they've disabled RC4 completely. Mozilla thinks so too, even in their "old backward compatibility" recommendations: https://wiki.mozilla.org/Security/Server_Side_TLS )

3DES is enough to support most older clients, at least on desktop. The problem is that it is the slowest cipher suite.

Reply on news.ycombinator.com