Hope I'm replying in the proper thread.
[quoted from: 2015-01-19 09:29:26 UTC]
@Outbreaker - please let 5eraph in on this. It would be cool if he could use whatever he likes. I look forward to eventually joining that community, but not at this time. We need some good members of both communities to help weave a greater community.
He just did. It's been over eight years since I've replied here. Nice to know my login still works.
[quoted from: 2015-01-07 09:22:51 UTC]
Note that 5eraph's specific SA3009008 solution appears incomplete at best, and perhaps even erroneous.
Look at the last two lines of that post, where TLS 1.0 is "enabled" with a 0x01. That is apparently incorrect.Microsoft wrote:"To allow this cipher algorithm, change the DWORD value data of the Enabled value to 0xffffffff. Or, change the DWORD data to 0x0. If you do not configure the Enabled value, the default is enabled."
http://support.microsoft.com/kb/245030 see also: http://support.microsoft.com/kb/187498 & http://support.microsoft.com/kb/811833Is this not also true for protocols?
To be fair, I can't take credit or blame for the solution I offer. It consists almost entirely of Microsoft's recommendations from SA3009008. Beyond what Microsoft suggests, I made an assumption and added the Enabled values of 1 to the TLS 1.0 registry keys. I don't know if protocol entries should share the same values as cipher algorithm entries. Wasn't aware Enabled could take any values other than 0 or 1, despite it being a DWORD.
I'll gladly remove the TLS 1.0 entries if there are any objections. Don't know how to test the effectiveness of different values on my PC.
[quoted from 2015-01-07 04:54:37 UTC]
i think [XP_KB3009008_Schannel_Registry_Mods_by_TechDud.zip] should not be forced unto usesrs because with this patch people won't be able to connect to outdated HTTPS servers.
Don't have this ZIP, so I can't comment on everything it contains. Haven't looked too closely at the latest release yet: NT5_IIS_KB245030-3009008_Schannel_Registry_Mods_Jan23-2015.zip. And can't really comment intelligently on the suggested workarounds for IIS given in SA3009008--don't know how to test them. But the IE suggestion has already been implemented in Firefox, and is sure to follow in other browsers.
[quoted from Mozilla Security Blog]
SSLv3 will be disabled by default in Firefox 34, which will be released on Nov 25 [2014].
Microsoft has announced in SA3009008 that SSLv3 will be disabled in IE "over the coming months." When that happens, I'll remove that code from my XPx64 update pack and POSReady addon. I expect the fix will be included in the ieuinit.inf file of a future cumulative IE update, where an old registry entry for SecureProtocols already exists.