5 ms·
Privaxy is matching chrome on https://badssl.com/dashboard/ https://badssl.com/dashboard/ and https://www.ssllabs.com/ssltest/viewMyClient.html https://www.ssll
by pierrebarre 4y ago
Privaxy is matching chrome on https://badssl.com/dashboard/ https://badssl.com/dashboard/ and https://www.ssllabs.com/ssltest/viewMyClient.html https://www.ssllabs.com/ssltest/viewMyClient.html except that Privaxy doesn't support older TLS versions and poorer ciphers.
It does not mean that there is not a single bug, but I do not think it is fair to completely discount this approach. Especially when the alternative is browser extensions which bring their fair share of trouble regarding trust, performance, limited capabilities or even security.
- rfd4sgmk8u 4y agoI discount this approach. It is necessary but not sufficient to pass on simple browser SSL tests. There are other complexities that are best left to the browser to negotiate the session.
- pierrebarre 4y agoWhat are the things that you think are best handled by the browser while negotiating a session?
- rfd4sgmk8u 4y agoThe connection parameters including encryption parameters and certificate from the origin. There are a lot of weird rules in WebPKI you may miss, this is beyond a general purpose TLS library. Enforcing Certificate Transparency rules or CAA records, is the proxy doing this?
- ThePowerOfFuet 4y agoWhich browser enforces CAA? it's a certificate misissuance, but AFAIK it's not up to the browser.