Tag Info

New answers tagged

0

I don't know how the audio playing is done on the device, but if an external application outside chrome is used for download the content, then the problem might be the use of SNI (Server Name Indication). Some Android applications still have problems with SNI, especially if they where built with Apaches HTTP client library. But, your site requires SNI. That ...


4

Read Google Chrome's privacy policy here Navigational errors caused are resolved automatically through Google servers. You can disable them in the Settings > Advanced Settings > Privacy. In fact, you may disable all checkboxes in Privacy section in order to not allow contacting Google every time you search something. You can also block cookies from Google ...


2

Yes, it is sending the information to Google but It uses your computer's dns server. In Google you even have an ad ID correlated with you. This way they get to know your interests and give you according advertisements. However, I think that with incognito mode it doesn't send anything, because that's the point of it. EDIT: [This part is about incognito] ...


2

Some companies have proxy servers that perform a MITM attack on all https traffic going through a company. So while SSL3 may be disabled on your browser, it might not be disabled on the proxy server, and the proxy server is what establishes the SSL connection to the test servers you're accessing. If that's the case, you need to update your proxy server to ...


0

Using the updated browsers isn't the mitigation for POODLE attack. The protocol SSLv3 should be disabled from the browser so that it starts a session only with TLS v1.0 . The mitigation for POODLE attack includes: 1.Disabling the support for SSLv3.0 from the server. 2.Disabling the support for SSLv3.0 from the browser. 3.Prevent TLS downgrade attacks by ...


0

No, and it doesn't seem likely to be added as a feature. See https://code.google.com/p/chromium/issues/detail?id=107793#c20 I'm just deeply concerned about the code complexity cost here, which increases the opportunity for both performance and security bugs. - rsleevi@chromium.org


3

Your exact case is that RSA is used as the key exchange mechanism. Instead, you should use DHE_RSA or ECDHE_RSA. Modern cryptography = TLS 1.2 or QUIC (protocol) + AES_128_GCM or CHACHA20_POLY1305 (cipher) + DHE_RSA or ECDHE_RSA or ECDHE_ECDSA (key exchange). Twitter discussion: https://twitter.com/reschly/status/534956038353477632 Commit: ...


0

Since the protocol version is good and AES_128-GCM is certainly not obsolete the remaining possibility is that something is wrong with the RSA key exchange. I'm not sure what google chrome understands as obsolete, but just the fact that key exchange is performed using RSA is not particularly good. Preferably RSA should only be used for authentication and the ...


2

That message probably indicates you're Using SSLv3, or Have a certificate signed with SHA-1 or MD5 According to this page. The former is a configuration issue, the latter require you to get a certificate signed with a SHA-256 hash.


27

Your certificate only contains a sha1 signature, probably with a lifetime past 1 January 2017. These are deprecated, and Chrome therefore removes the appearance of security. See https://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html for more info.


1

you can make it local by giving permission on extention folder in this path C:\Users\*your user*\AppData\Local\Google\Chrome\User Data\Default\Extensions rightclick->security-> select user-> deny all


2

As of January 1, 2015 all EV certificates are required to have public audit records (Signed Certificate Timestamps). The most common way of including these records is through Embedded SCTs. This method includes a new certificate extension/OID (1.3.6.1.4.1.11129.2.4.2) in the certificate file itself. For OV and DV certificates, you can request that your CA ...



Top 50 recent answers are included