-7

Multiple vulnerabilities have basically obsoleted TLS_RSA, CBC and QUIC implementations.

February 9, 2019:

"Seven researchers from all over the world found --yet again-- another way to break RSA PKCS#1 v1.5, the most common RSA configuration used to encrypt TLS connections nowadays. Besides TLS, this new Bleichenbacher attack also works against Google's new QUIC encryption protocol as well."

https://www.zdnet.com/article/new-tls-encryption-busting-attack-also-impacts-the-newer-tls-1-3/

Feburary 8 2019:

"Craig Young, a computer security researcher for Tripwire's Vulnerability and Exposure Research Team, found vulnerabilities in SSL 3.0's successor, TLS 1.2, that allow for attacks akin to POODLE due to TLS 1.2's continued support for a long-outdated cryptographic method: cipher block-chaining (CBC). The flaws allow man-in-the-middle (MitM) attacks on a user's encrypted Web and VPN sessions."

Source: https://www.darkreading.com/vulnerabilities---threats/new-zombie-poodle-attack-bred-from-tls-flaw/d/d-id/1333815

Answer #1 below explains how to disable some these by command line, however unpractical it is to do so. Part of the answer involves browser developers making cipher selection far more accessible to your average user; for example, make them as accessible as cookie settings.

closed as off-topic by Steffen Ullrich, schroeder Feb 11 at 13:31

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

-6

This effectively worked for me on the latest Chrome Beta. Google has since disabled QUIC on youtube, but just to be safe, don't forget to disable QUIC under about:flags.

Quoting what another source told me:

At least latest windows version of Chrome works with this:

chrome --cipher-suite-blacklist=0x009c,0x009d,0x002f,0x0035,0x000a

That makes all the TLS_RSA_* ciphers go away.

Can't Google give more friendly way to enable/disable ciphers than the command line? I mean, even my crappy own privacy browser had a better way, not only disabling/enabling but also specifying the order of ciphers wanted directly from GUI...and that was in 2013 ... "

I too find chromes weak command line only implementation impractical, while also omitting security entirely when loading URL's outside of the 'shortcut' or commandline, like an email application or "Microsoft" help URL. Also, one must check routinely to ensure google has not changed the commandline code yet again (which broke my previous settings), or as I have, switch to FireFox.

The most reasonable answer is to fix the problem at the source. I have made a feature request, you can add your rationale for adding better functionality on my bug report/feature request. This will also allow users to remove vulnerable ciphers in zero-day instances, rather than having to wait for developers to plug the holes.

Browser developers need to educate people far more on ciphers, make it just as accessible and informative as cookies; this is critical. Billions of people are at risk without practical measures.

  • 3
    As noted by a Chromium dev here, disabling these ciphers on your client doesn't protect you. If the server supports the ciphers using a vulnerable library (the ciphers themselves are not vulnerable, it is certain implementations) then an attacker can use the vulnerability to exploit otherwise secure ciphers as well. – AndrolGenhald Feb 12 at 17:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.