User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20100101 Firefox/13.0.1 Build ID: 20120616215704 Steps to reproduce: Hello, Reading the default security configuration of Firefox I found that 2 really deprecated cryptographic functions are enabled by default : - MD5 based signature. - RC4 encryption. RC4 is often preferred by service providers because of this cypher has a lower CPU cost than others. The result is that if RC4 is enabled in the browser, this cypher is often the one that will be used. I tested a configuration that disable those functions with a lot of HTTPS websites and it works very well. So I think disabling RC4 encryption and MD5 based signature would significantly improve the TLS/SSL communications security. I attach a patch of the file : /netwerk/base/public/security-prefs.js HardKor 5845 16EB 0589 B89A 5E6E 98DE 74F5 F875 6D34 45F9

see bug 650355 and bug 732673 This is probably a dupe of bug 732673

(In reply to Matthias Versen (Matti) from comment #1) > see bug 650355 and bug 732673 > This is probably a dupe of bug 732673 Not exactly, my patch is more complete and also disable RC4 with other algorithms than MD5.

People have argued that the use MD5 in a ciphersuite is still fine, see bug 732673 comment 4 so that part of your proposal is invalid at this time. The remainder of your patch suggests to disable all RC4 ciphersuites, so I'm changing the subject accordingly. (please use unified diffs -u when attaching future patches)

HardKor: thank you for the patch and the suggestion. The use of RC4 in SSL/TLS is generally considered secure. I tried to disable TLS_RSA_WITH_RC4_128_MD5 in Google Chrome in March of this year. I had to revert that change after only a week of testing in Google Chrome's "Canary" release channel because some websites enable TLS_RSA_WITH_RC4_128_MD5 only. See the Chromium bug report http://code.google.com/p/chromium/issues/detail?id=118330 for a list of those websites. (Some of them are in the duplicate bugs.) I suspect those websites are still TLS_RSA_WITH_RC4_128_MD5 only today. So I believe your patch will have the same fate if we check it in. Sorry.

Please reopen this. RC4 can not be considered safe anymore: "There's no reason to panic here. But let's start to move away from RC4 to something like AES." https://www.schneier.com/blog/archives/2013/03/new_rc4_attack.html "According to AlFardan, Bernstein, Paterson, Poettering and Schuldt (a team from Royal Holloway, Eindhoven and UIC) the RC4 ciphersuite used in SSL/TLS is broken" http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html

Bug 999544 was filed instead of reopening this. Changing the confusing resolution.