Take the 2-minute tour ×
Stack Apps is a question and answer site for apps, scripts, and development with the Stack Exchange API. It's 100% free, no registration required.

Each time an API request is made over HTTPS, Firefox generates the following message in the error console:

enter image description here

Curious, I looked up RFC 5746 and the document covers the following:

Transport Layer Security (TLS) Renegotiation Indication Extension

Secure Socket Layer (SSL) and Transport Layer Security (TLS) renegotiation are vulnerable to an attack in which the attacker forms a TLS connection with the target server, injects content of his choice, and then splices in a new TLS connection from a client. The server treats the client's initial TLS handshake as a renegotiation and thus believes that the initial data transmitted by the attacker is from the same entity as the subsequent client data. This specification defines a TLS extension to cryptographically tie renegotiations to the TLS connections they are being performed over, thus preventing this attack.

(Emphasis mine.)

I realize that this probably isn't a terribly serious problem, but it does appear to be a bit of a security concern. Is there any chance this could be fixed?


Edit: not sure if it's related, but it gets worse:

enter image description here

I get this dialog box in Firefox 9.1 if I attempt to authenticate an app using the implicit flow.

share|improve this question
    
Have you tried not on Windows 8? –  Jonathan. Jan 6 '12 at 17:01
    
Nope. But I can ask someone on Ubuntu to try it later on and see if they get the warning. –  Nathan Osman Jan 6 '12 at 18:40
    
We don't use akamai ... do you have a proxy server on your end that could be using their services? –  Zypher Jan 6 '12 at 19:15
    
@Zypher: Do you use Quantserve? –  Nathan Osman Jan 6 '12 at 19:20
    
Nope, well, we have the quantcast stuff on the main sites but i double kevin put it in the api ... –  Zypher Jan 6 '12 at 19:34
    
@Zypher: The API does have auth pages... that's where I'm getting the error - could that be it? –  Nathan Osman Jan 6 '12 at 19:36
    
have to let @kevinmontrose weigh in –  Zypher Jan 6 '12 at 19:37
    
I can't reproduce the dialog, and we don't have any links to Quantcast on the implicit dialog. Looking into the RFC 5746 stuff, doesn't look like an easy fix. –  Kevin Montrose Jan 9 '12 at 18:36
    
@KevinMontrose: Perhaps it's this page since my extension uses that. –  Nathan Osman Jan 10 '12 at 0:46
    
@GeorgeEdison - ah, that's more believable. Still can't get firefox to freak out with a dialog, but there is a dodge reference to quantcast there. –  Kevin Montrose Jan 10 '12 at 1:05
    
@KevinMontrose: Yeah, the dialog only shows up every once and a while. This might help: try visiting this link and see if the warning displays. It seems like a problem with edge.quantserve.com getting accessed over HTTPS. –  Nathan Osman Jan 10 '12 at 1:10
    
@GeorgeEdison give it a go again, offending content should be excised from that page. –  Kevin Montrose Jan 10 '12 at 1:50
    
@KevinMontrose: Seems to be working now. I haven't seen the warning anymore. –  Nathan Osman Jan 10 '12 at 2:08
add comment

1 Answer 1

up vote 1 down vote accepted

This is both and , really.

The offending material was excised a while ago, so that warning shouldn't be displayed ever.

The RFC 5746 message will go away when we next do an upgrade on our SSL load balancer... which is planned, but not going to happen over night either.

share|improve this answer
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .