ssleuth

ssleuth copied to clipboard

Web extensions are the future

39

The current plan is that Firefox 57 will only support [web extensions](https://wiki.mozilla.org/WebExtensions). Your add-on is not a web extension yet as far as I can see, so you should consider...

rugk

Maybe you can consider using [Liberapay](https://liberapay.com/) to collect donations? It is clearly a better alternative for free software than PayPal or so, and it is not just a one-time donation.

rugk

Show certificate transparency information

1

When this extension may finally be moved to WebExtensions, it'd also be nice to show certificate transparency information, if possible.

rugk

Not a bug, just a feature request/suggestion: The area where the numeric score is displayed (to the left of protocol) would be more legible to more people if you dispensed...

Lew-Rockwell-Fan

Display elliptic curves

8

It would be nice if the used elliptic curves could be displayed. More information: - https://security.stackexchange.com/questions/31772/what-elliptic-curves-are-supported-by-browsers - https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations#Supported_elliptic_curves

rugk

Missing space in validity with time

3

If the option "Show GMT/UTC time in validity" is activated, the time is directly concatenated to the date making it hard to read:  I've patched the output to add...

manuelmaurer

Add HSTS and HPKP

9

It would be good to also check whether the server is using [HTTP Strict Transport Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) and [HTTP Public Key Pinning](HTTP Public Key Pinning).

ghost

Wrong detection with TLS 1.3

5

Today I noticed that there are some Bugs when TLS 1.3 is used, specially the Ciphersuit and hence the score is wrong. (Possible because with the latest(?) Draft of TLS...

Der-Orden

Display individual scores of cipher (separate CBC and SHA1 in UI)

6

AES GCM is authenticated encryption and should therefore be considered more secure than AES CBC. See: - [Why is CBC with predictable IV considered insecure against CPA](https://crypto.stackexchange.com/questions/3883/why-is-cbc-with-predictable-iv-considered-insecure-against-cpa)

rugk

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 cipher suite inconsistent scoring

6

Excellent add-on, found one problem, this one cipher suite is scored 9.0 on some sites (example weakdh.org) and 10.0 on others (example usaa.com.) Is there a difference I'm not seeing?...

warp16