Removing SSLv3 in Chrome

Huge props to the Chromium team for doing this; it&#x27;s an excellent precedent.<p>SSLv3 is broken, and the only reason it&#x27;s been so well-supported is that the browsers were unwilling to break web servers; the operators of those servers can&#x27;t be counted on to fix them, and users direct their ire at the browser vendors. But apparently there&#x27;s a red line across which the browsers won&#x27;t make up for broken server configurations, and POODLE crossed it.

Why not go further?<p>I&#x27;d be all for very disturbing warnings for any version of TLS before 1.2, and somewhat scary warnings for low-security or non-PFS operational modes.<p>Basically, enough so that in a big company corporate would ring up the IT department to &quot;fix the ssl site for giving an error&quot;, but not enough so that everyone clicks through the &quot;ignorable warning&quot;.

The last update to Iceweasel in Debian stable disabled SSLv3 over a week ago. So far I&#x27;ve only encountered one website I frequent that will need intervention, but otherwise it was hardly noticeable.

Microsoft is planning the same: <a href="http://azure.microsoft.com/blog/2014/10/29/protecting-against-the-ssl-3-0-vulnerability/" rel="nofollow">http:&#x2F;&#x2F;azure.microsoft.com&#x2F;blog&#x2F;2014&#x2F;10&#x2F;29&#x2F;protecting-agains...</a>

I have an old raid controller from 3ware. The management software runs on localhost, but for illadvised security reasons forces HTTPS. One day I was not able to connect anymore (with a browser running on that machine!) I had to hunt down an old version of Firefox to still be able to connect.<p>Therefore it is a bad idea to not provide a fallback. It&#x27;s good if every login over the internet is proteceted by HTTPS and weak fallbacks are not used. But there are places where security is just irrelevant (like my localhost scenario, or legacy hardware in a trusted local network), where I&#x27;d rather have a way of doing a connection with any way possible, no matter how insecure. Old ciphers, old SSL, compatibility hacks etc.<p>I wish they would keep that code arount and make it possible to connect anyway

Imagine the day researchers announce RC4 has been cracked for sure.<p>What a nightmare that year is going to be - so many legacy devices.

The only time Chrome&#x27;s over-zealous security has even shown up for me is when it doesn&#x27;t let me login to WiFi that requires a login page. Which happens a lot. Oh, and maybe once the site in question had an expired certificate and I had to use another browser to access it. Wonderful.

From the thread:<p>&quot;While we&#x27;re at it, can we add one of those glorious SSL failure screens to any sites that don&#x27;t use HTTPS in a future version of Chrome?&quot;<p>&quot;We are working on something like that, but gentler.&quot;<p>YMMV, but: ugh.