2

Each time an API request is made over HTTPS, Firefox generates the following message in the error console:

enter image description here

Curious, I looked up RFC 5746 and the document covers the following:

Transport Layer Security (TLS) Renegotiation Indication Extension

Secure Socket Layer (SSL) and Transport Layer Security (TLS) renegotiation are vulnerable to an attack in which the attacker forms a TLS connection with the target server, injects content of his choice, and then splices in a new TLS connection from a client. The server treats the client's initial TLS handshake as a renegotiation and thus believes that the initial data transmitted by the attacker is from the same entity as the subsequent client data. This specification defines a TLS extension to cryptographically tie renegotiations to the TLS connections they are being performed over, thus preventing this attack.

(Emphasis mine.)

I realize that this probably isn't a terribly serious problem, but it does appear to be a bit of a security concern. Is there any chance this could be fixed?

Edit: not sure if it's related, but it gets worse:

enter image description here

I get this dialog box in Firefox 9.1 if I attempt to authenticate an app using the implicit flow.

Improve this question
13
  • Have you tried not on Windows 8?
    – Jonathan.
    Commented Jan 6, 2012 at 17:01
  • Nope. But I can ask someone on Ubuntu to try it later on and see if they get the warning.
    – Nathan Osman
    Commented Jan 6, 2012 at 18:40
  • We don't use akamai ... do you have a proxy server on your end that could be using their services?
    – Zypher
    Commented Jan 6, 2012 at 19:15
  • @Zypher: Do you use Quantserve?
    – Nathan Osman
    Commented Jan 6, 2012 at 19:20
  • Nope, well, we have the quantcast stuff on the main sites but i double kevin put it in the api ...
    – Zypher
    Commented Jan 6, 2012 at 19:34
  • @Zypher: The API does have auth pages... that's where I'm getting the error - could that be it?
    – Nathan Osman
    Commented Jan 6, 2012 at 19:36
  • have to let @kevinmontrose weigh in
    – Zypher
    Commented Jan 6, 2012 at 19:37
  • I can't reproduce the dialog, and we don't have any links to Quantcast on the implicit dialog. Looking into the RFC 5746 stuff, doesn't look like an easy fix.
    – Kevin Montrose
    Commented Jan 9, 2012 at 18:36
  • @KevinMontrose: Perhaps it's this page since my extension uses that.
    – Nathan Osman
    Commented Jan 10, 2012 at 0:46
  • @GeorgeEdison - ah, that's more believable. Still can't get firefox to freak out with a dialog, but there is a dodge reference to quantcast there.
    – Kevin Montrose
    Commented Jan 10, 2012 at 1:05
  • @KevinMontrose: Yeah, the dialog only shows up every once and a while. This might help: try visiting this link and see if the warning displays. It seems like a problem with edge.quantserve.com getting accessed over HTTPS.
    – Nathan Osman
    Commented Jan 10, 2012 at 1:10
  • @GeorgeEdison give it a go again, offending content should be excised from that page.
    – Kevin Montrose
    Commented Jan 10, 2012 at 1:50
  • @KevinMontrose: Seems to be working now. I haven't seen the warning anymore.
    – Nathan Osman
    Commented Jan 10, 2012 at 2:08

1 Answer 1

Reset to default
1

This is both and , really.

The offending material was excised a while ago, so that warning shouldn't be displayed ever.

The RFC 5746 message will go away when we next do an upgrade on our SSL load balancer... which is planned, but not going to happen over night either.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .