K-Meleon :: General

General : K-Meleon Forum

General discussion about K-Meleon.

Goto: Forum List•Message List•Search•Log In

Your Name:
Subject:

Help information

[quote=guenter]
[quote=JamesD]
[quote=gordon451]
I assume KM does support TLS1.2/SSL3.3? 
[/quote]

I wonder if this is dependent on the version of the Gecko engine being used in KM.
[/quote]

AFAIK K-Meleon supports nothing but TLS 1.0

TLS 1.1: https://bugzilla.mozilla.org/show_bug.cgi?id=565047
TLS 1.2: https://bugzilla.mozilla.org/show_bug.cgi?id=480514

[quote="2 persons @ bugzilla"]
Adam Rak      2011-09-21 10:39:45 PDT

Unfortunately the server support is very poor, but on the bright side, THIS server (which has this bugzilla) does support TLS 1.1. (BUT ssllabs.com does support TLS 1.1/1.2!)

Many cites very poor browser support as the reason why they won't implement TLS/1.1 or 1.2
So that's a good reason to implement it on firefox.

IE market share: 38.9%     -> implements it (only latests versions), hopefully working..
Firefox market share: 25.5% -> no implementation
Chrome 20.2% -> no implementation
(according to wikipedia, these percentages might be skewed a bit)

So if there are an implementation for Firefox and Chrome then we can say that significant percentage of the browsers do support it, so its more likely to happen at the server side too. (And implementing in Firefox speeds up the Chrome implementation too.) Someone has to make the first step after all. And you already have some patches so I don't worry too much for browsers. But a little more "noise" to convince people to elevate the priority won't hurt.

Comment 56 dziastinux 2011-09-21 22:32:56 PDT

TLS 1.0 is no longer considered as secure. So this bug MUST marked as major.

[/quote]

[hr]

The bad news first the FF extension ForceTLS does not seem to work for K-Meleon.

Some parts of the Force TLS extension for Firefox should have worked out of the box.

http://forcetls.sidstamm.com/

[quote=Sid Stammm]

The add-on more or less works autonomously in the background, so you shouldn't have to do much to help it work. If you want, you can enable debugging and watch status messages pop up in the Javascript error console. You can also add sites to the ForceTLS database yourself, and force HTTPS requests for sites that may not even know ForceTLS exists.
[/quote]

So i added its ./components and put ForceTLSUtils.jsm into modules.
It did not create forcetls_db.sqlite or any new database file for a site like paypal.com [url=https://crypto.stanford.edu/forcehttps/]which according to my info supports the extension[/url].

[quote=crypto.stanford.edu]
In September 2009, PayPal published an updated version of the protocol. As of this writing (November 2009), the updated protocol has been adopted by Google Chrome and NoScript, and implementation is underway in Firefox. The Strict-Transport-Security header is in use on a number of high-security web sites, including PayPal. ...

ForceHTTPS comes with preconfigured protection for Gmail, PayPal, American Express, Bank of America, Chase, and  Fidelity. 
[/quote]

For this reason I tried with the subsequent prefs from force_tls 1.0.3

[code]
// -- rule.<domain> = true
//    ... sets force TLS on that domain for one year from Firefox launch
pref("extensions.forcetls@sid.stamm.permanant.rule.paypal.com", true);

// -- subd.<domain>: set this to false or omit it to avoid including subdomains
pref("extensions.forcetls@sid.stamm.permanant.subd.paypal.com", true);
[/code]

When it did not create a database I stopped work and only had a quick look at the needed XUL fixing & calling without investing any amount of work.

The adding & editing should work. 
It is done by a "window" and that can be used & called by a trivial kmm.
Trivial = change a few lines in an existing kmm like mytypes.kmm.
& Repackage the XUL and fix the manifest for K-Meleon use to use it.

[img]http://forcetls.sidstamm.com/settingswindow.png[/img]

But the quick adding's overlay will never work. That is a true "overlay" which adds an alteration to a FF GUI item. So K-Meleon cannot use it.

[img]http://forcetls.sidstamm.com/pageinfowindow.png[/img][/quote]

K-Meleon forum is powered by Phorum.