Re: CVE Request?: konqueror - https uses all ciphers, even weak ones

[John Haxby <john.haxby () oracle com>]

On 4 Mar 2014, at 11:01, Daniel Kahn Gillmor <dkg () fifthhorseman net> wrote:

> Here is another situation where konqueror successfully indicates a
> "secure" connection to a server that has a known-insecure configuration:
> point konqueror at: https://demo.cmrg.net/ -- you'll see a successful
> connection, though that server only offers DHE over a
> trivially-crackable 16-bit group.

I suspect that this problem is fairly wide-ranging.   Apple’s Safari also permits the link.   Google Chrome doesn’t 
permit the link though, it just crashes :)

jch

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail