I am making this issue to propose that weak ciphers and more specifically CBC (Cipher Block Chaining) ciphers should be blacklisted from Trivalent. CBC is considered {weak, insecure} and has led to Zombie POODLE and GOLDENDOODLE.
Possible issues that could arise from disabling CBC
As I've been informed in the discord, some sites such as FSF's depend on CBC, so this is a bullet that has to be taken to achieve better security, so it depends on the trivalent devs to either act or decline this report.
An alternative way to handle this is to inform that the site uses weak ciphers in a clear way thats understable by the user.
(Screenshot from trivalent doing the SSLLab Test Your Browser check)
I am making this issue to propose that weak ciphers and more specifically CBC (Cipher Block Chaining) ciphers should be blacklisted from Trivalent. CBC is considered {weak, insecure} and has led to Zombie POODLE and GOLDENDOODLE.
Possible issues that could arise from disabling CBC
As I've been informed in the discord, some sites such as FSF's depend on CBC, so this is a bullet that has to be taken to achieve better security, so it depends on the trivalent devs to either act or decline this report.
An alternative way to handle this is to inform that the site uses weak ciphers in a clear way thats understable by the user.
(Screenshot from trivalent doing the SSLLab Test Your Browser check)