up vote 6 down vote favorite
share [g+] share [fb]

I'm really confused -- why are some of the TLS/SSL options turned off by default?

enter image description here

Is there any harm in turning them on or something?

link|improve this question
69% accept rate
feedback

3 Answers

up vote 8 down vote accepted

Actually, it is safer to use TLS 1.1 / 1.2, as recent reports have shown vulnerability while utilizing TLS 1.0. Source: http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/

As per the above report, the reason TLS 1.0 is still used because:

Chief culprits for the inertia are the Network Security Services package used to implement SSL in Mozilla's Firefox and Google's Chrome browsers, and OpenSSL, an open-source code library that millions of websites use to deploy TLS. In something of a chicken-and-egg impasse, neither toolkit offers recent versions of TLS, presumably because the other one doesn't.

“The problem is people will not improve things unless you give them a good reason, and by a good reason I mean an exploit,” said Ivan Ristic, Qualys's director of engineering. “It's terrible, isn't it?”

While both Mozilla and the volunteers maintaining OpenSSL have yet to implement TLS 1.2 at all, Microsoft has performed only slightly better. Secure TLS versions are available in its Internet Explorer browser and IIS webserver, but not by default. Opera also makes version 1.2 available but not be default in its browser.

.

Microsoft has a Security Advisory out for a SSL vulnerability and recommends enabling TLS v1.1, there is a fixit on this page to assist in enabling it properly.

. http://support.microsoft.com/kb/2588513

.

link|improve this answer
1  
I have indeed read that article, but what I don't understand is: Why not check everything? It's not like it's going to favor TLS 1.2 over TLS 1.0 when both are available, is it? – Mehrdad Oct 2 '11 at 8:14
@Mehrdad: It's going to favor the newest, most secure version -- and 1.2 is newer than 1.0. – grawity Oct 2 '11 at 11:40
feedback
up vote 6 down vote

SSL 2.0 is unsafe. SSL 3.0 and TLS 1.0 are most prevalent. But as Ar Sh mentioned, there are reports of vulnerability in TLS 1.0.

Since most web servers implement SSL 3.0 and TLS 1.0, most web browsers still use them and are the defaults.

IN my opinion, you can enable TLS 1.1 and 1.2 but avoid enabling SSL 2.0 as it is unsafe.

link|improve this answer
Does SSL 2.0 being on affect the use of SSL 3.0? If so, why? (If not, then why should it be off? It can't be worse than lack of any encryption...) – Mehrdad Oct 2 '11 at 8:16
2  
SLL 2.0 is weaker than SSL 3.0. During handshake, the web server can ask the browser to use the weaker encryption if you enable the option. Now imagine you are using a banking application, would you prefer to login with weak encryption or not login at all? – Ganesh R. Oct 2 '11 at 8:22
That's a tough question! I'm not sure... +1 – Mehrdad Oct 2 '11 at 8:25
Due to its insecurity, SSL 2.0 is disabled in almost all webservers today. No sense in enabling it in your browser. – grawity Oct 2 '11 at 11:41
feedback
up vote 1 down vote

tls > 1.0 interop issues have never been fully worked out due to lack of adoption, so to be safe many vendors don't even enable it by default when it could just be negotiated down.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.