[9fans] IWP9 Website troubles

[9fans] IWP9 Website troubles

[Willow Liquorice]

Hello,

Just thought I'd mention that my browser does *not* like connecting to 
the IWP9 website. It's complaining about the site doing an "old-style 
(potentially unsafe) handshake" – SSL_ERROR_UNSAFE_NEGOTIATION.

Is this a quick fix on either end?

        - Willow

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T6492d49f521453ea-Mf5610d7e597d58f8faed46d4
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] IWP9 Website troubles

[Skip Tavakkolian]

[-- Attachment #1: Type: text/plain, Size: 1071 bytes --]

I think that's expected, but it's an issue that should be fixed.

As I understand it,  the warning is because AES_128_CBC is susceptible to
Padding Oracle attack (depending on implementation) and when TLS only uses
RSA key exchange, it doesn't provide forward secrecy (interloper can
passively record then decrypt).

There isn't anything on the site that would be worth the hacking trouble.
It is just static content and no JavaScript was (ab)used in any of it.


On Mon, Mar 24, 2025, 8:12 AM Willow Liquorice <willow@howhill.com> wrote:

> Hello,
> 
> Just thought I'd mention that my browser does *not* like connecting to
> the IWP9 website. It's complaining about the site doing an "old-style
> (potentially unsafe) handshake" – SSL_ERROR_UNSAFE_NEGOTIATION.
> 
> Is this a quick fix on either end?
> 
> - Willow

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T6492d49f521453ea-Md5547dc8df967f3f936671d6
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 2558 bytes --]

Re: [9fans] IWP9 Website troubles

[Daniel Maslowski via 9fans]

[-- Attachment #1: Type: text/plain, Size: 1621 bytes --]

Are you making changes? The website is currently broken via HTTPS.

On Mon, 24 Mar 2025, 19:29 Skip Tavakkolian, <skip.tavakkolian@gmail.com>
wrote:

> I think that's expected, but it's an issue that should be fixed.
>
> As I understand it,  the warning is because AES_128_CBC is susceptible to
> Padding Oracle attack (depending on implementation) and when TLS only uses
> RSA key exchange, it doesn't provide forward secrecy (interloper can
> passively record then decrypt).
>
> There isn't anything on the site that would be worth the hacking trouble.
> It is just static content and no JavaScript was (ab)used in any of it.
>
>
> On Mon, Mar 24, 2025, 8:12 AM Willow Liquorice <willow@howhill.com> wrote:
>
>> Hello,
>> 
>> Just thought I'd mention that my browser does *not* like connecting to
>> the IWP9 website. It's complaining about the site doing an "old-style
>> (potentially unsafe) handshake" – SSL_ERROR_UNSAFE_NEGOTIATION.
>> 
>> Is this a quick fix on either end?
>> 
>> - Willow
> *9fans <https://9fans.topicbox.com/latest>* / 9fans / see discussions
> <https://9fans.topicbox.com/groups/9fans> + participants
> <https://9fans.topicbox.com/groups/9fans/members> + delivery options
> <https://9fans.topicbox.com/groups/9fans/subscription> Permalink
> <https://9fans.topicbox.com/groups/9fans/T6492d49f521453ea-Md5547dc8df967f3f936671d6>
>

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T6492d49f521453ea-Mf88b450fdfa46eec52db1331
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 3024 bytes --]

Re: [9fans] IWP9 Website troubles

[Daniel Maslowski via 9fans]

[-- Attachment #1: Type: text/plain, Size: 1781 bytes --]

Just FYI, it is back again.

On Mon, Mar 24, 2025 at 10:03 PM Daniel Maslowski <cyrevolt@googlemail.com>
wrote:

> Are you making changes? The website is currently broken via HTTPS.
>
> On Mon, 24 Mar 2025, 19:29 Skip Tavakkolian, <skip.tavakkolian@gmail.com>
> wrote:
>
>> I think that's expected, but it's an issue that should be fixed.
>>
>> As I understand it,  the warning is because AES_128_CBC is susceptible to
>> Padding Oracle attack (depending on implementation) and when TLS only uses
>> RSA key exchange, it doesn't provide forward secrecy (interloper can
>> passively record then decrypt).
>>
>> There isn't anything on the site that would be worth the hacking trouble.
>> It is just static content and no JavaScript was (ab)used in any of it.
>>
>>
>> On Mon, Mar 24, 2025, 8:12 AM Willow Liquorice <willow@howhill.com>
>> wrote:
>>
>>> Hello,
>>> 
>>> Just thought I'd mention that my browser does *not* like connecting to
>>> the IWP9 website. It's complaining about the site doing an "old-style
>>> (potentially unsafe) handshake" – SSL_ERROR_UNSAFE_NEGOTIATION.
>>> 
>>> Is this a quick fix on either end?
>>> 
>>> - Willow
>> *9fans <https://9fans.topicbox.com/latest>* / 9fans / see discussions
>> <https://9fans.topicbox.com/groups/9fans> + participants
>> <https://9fans.topicbox.com/groups/9fans/members> + delivery options
>> <https://9fans.topicbox.com/groups/9fans/subscription> Permalink
>> <https://9fans.topicbox.com/groups/9fans/T6492d49f521453ea-Md5547dc8df967f3f936671d6>
>>

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T6492d49f521453ea-M048e8eb1a1ceccd61ab74463
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 3483 bytes --]