Take the 2-minute tour ×
Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It's 100% free, no registration required.

I recently visited https://www.howsmyssl.com/ with TorBrowser Bundle 3.5 and the rating was alarming. In particular, the site informed me that the cipher SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA was insecure and that TLS 1.0 was also a risk. I realize that customizing the browser in any way diminishes my anonymity by increasing my fingerprint, but I would prefer more secure SSL over improved anonymity. What are my options to improve this ?

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

One possible solution is to disable the offending cipher by visiting about:config and setting the ciphers you don't want to false. Something like:

security.ssl3.rsa_fips_des_ede3_sha    false

You could also improve your security by allowing TLS1.1 and 1.2 which are disabled by default in Firefox:

security.tls.version.max               3

See my blog post on the topic for more info (and for why this isn't the default).

Always keep in mind that sites like How's my SSL are useful tools, but that there might be other consequences (aside from fingerprinting) that aren't immediately obvoius.

share|improve this answer
    
wow, great answer- thanks! –  Ivar Feb 4 at 18:51
    
Note that Firefox 27 was just released which has TLS 1.1 and 1.2 on by default. –  Sam Whited Feb 5 at 13:31
add comment

The site is not quite right about the SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA cipher. As I wrote in my blog post on configuring SSL in a secure way this is not a bad cipher. It offers the same security as other cyphers which are considered secure by the HowsMySSL-site. So it is not necessary to disable it.

When you want to disable it, enter about:config in the address bar. The site will first print a warning, so be careful with changes. The following site has a search bar, enter fips there and you'll find the cipher. You can set it to false by double-clicking on the line.

As Sam wrote you should also raise the enabled TLS versions. Just enter version into the address bar and set security.tls.version.max to 3 (double-click). However Firefox just released version 27. It enables TLS1.1 and TLS1.2 by default.

I played around with the minimum version in Firefox. When setting the minimum to 2 (TLS1.1) some websites break. I collected some sites, but probably there are many more. So at the moment it might be good to set the minimum value to 1.

share|improve this answer
2  
Just a quick addition - this site (i.e. tor.stackexchange.com) will NOT work if the security.tls.version.min is set to anything higher than 1. –  Ivar Feb 4 at 21:13
    
That is right. At the moment no SE site does support TLS1.1 or better. –  Jens Kubieziel Feb 4 at 21:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.