How can I improve my SSL/TLS security?

Question

I recently visited https://www.howsmyssl.com/ with TorBrowser Bundle 3.5 and the rating was alarming. In particular, the site informed me that the cipher SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA was insecure and that TLS 1.0 was also a risk. I realize that customizing the browser in any way diminishes my anonymity by increasing my fingerprint, but I would prefer more secure SSL over improved anonymity. What are my options to improve this ?

Answer 1

One possible solution is to disable the offending cipher by visiting about:config and setting the ciphers you don't want to false. Something like:

security.ssl3.rsa_fips_des_ede3_sha    false

You could also improve your security by allowing TLS1.1 and 1.2 which are disabled by default in Firefox:

security.tls.version.max               3

See my blog post on the topic for more info (and for why this isn't the default).

Always keep in mind that sites like How's my SSL are useful tools, but that there might be other consequences (aside from fingerprinting) that aren't immediately obvoius.

Answer 2

The site is not quite right about the SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA cipher. As I wrote in my blog post on configuring SSL in a secure way this is not a bad cipher. It offers the same security as other cyphers which are considered secure by the HowsMySSL-site. So it is not necessary to disable it.

When you want to disable it, enter about:config in the address bar. The site will first print a warning, so be careful with changes. The following site has a search bar, enter fips there and you'll find the cipher. You can set it to false by double-clicking on the line.

As Sam wrote you should also raise the enabled TLS versions. Just enter version into the address bar and set security.tls.version.max to 3 (double-click). However Firefox just released version 27. It enables TLS1.1 and TLS1.2 by default.

I played around with the minimum version in Firefox. When setting the minimum to 2 (TLS1.1) some websites break. I collected some sites, but probably there are many more. So at the moment it might be good to set the minimum value to 1.