2

As of Firefox 39, Mozilla has dropped support for SSL3 and RC4... and whitelisted 519 (!) non-compliant sites: (https://mxr.mozilla.org/mozilla-release/source/security/manager/ssl/src/IntolerantFallbackList.inc), including such juicy ones as:

login.chicagopolice.org
partnerweb.vmware.com
www2.bancobrasil.com.br
www.publicjobs.ie
www.londonstockexchange.com
www.americanairlines.com
starbucks.com

(and a bunch of others - financial institutions, media companies, whatever rocks the boat).

How should the users be made aware of the remaining security holes?

Bugzilla discussion for ref: https://bugzilla.mozilla.org/show_bug.cgi?id=1128227

5
  • 1
    I'm voting to close this down: there is no answer to that question that isn't a direct consequence of your own activities.
    – Stephane
    Jul 6, 2015 at 7:52
  • 3
    I'm afraid that it isn't solving the fundamental problem: this question cannot be answered without taking into account the environment. At best it could trigger a discussion but that isn't what this site is for.
    – Stephane
    Jul 6, 2015 at 7:57
  • The fundamental problem is with Mozilla. Do they charge money for leaving the sites available through Firefox? Jul 6, 2015 at 8:03
  • Related: security.stackexchange.com/questions/23646/… (same province/question modality) Jul 6, 2015 at 9:07
  • 3
    Actually the release notes were wrong.RC4 is STILL GLOBALLY ENABLED. It's a bug. See this tweet (Archived here.) Jul 6, 2015 at 9:15

0

Browse other questions tagged .