[adamlau]

Official Site: https://weakdh.org/



Has this been discussed here @ CB yet?

[Ment]

It has similarities to the FREAK https attack that was discussed in several threads here in that it involves lowering the decryption standard of a protocol. I'm sure BB is aware of it by now as its made its way thru the security news sites. Funny that IE is the only browser that doesn't have the vulnerability.

[Superdupont 2_0]

Afaik server and client must be both supporting export cipher suites, otherwise the attack doesn't work.

If your e-mail server doesn't support export cipher suites, you should be safe.

My BB 10 browser seems to be vulnerable, so that's a bad start.


Posted via CB10

[MeerMusik]

Regarding Browser Side safety:
- Opera 29.0: Not Safe
- Chrome 43.0.2357.65m: Not Safe
[All Versions are the latest available -checked or updated 5 Minutes ago]

- Internet Explorer: removed longtime ago from my PC. Therefore untested.

- Firefox 38.0.1: Safe
This Version was released a couple of days before the Logjam Report came up. Mozilla is disabling more and more weak Cipher and / or Key Combinations for quite a while now.

I am not fully up2date what Opera and Google are doing regarding SSL / TLS.

EDIT01:
BlackBerry Browser on 10.3.2.680: Not Safe

Via CB10 App. STL100-2 @ 10.3.2.B

[itzJustMeh]

- Firefox 38.0.1: Safe
This Version was released a couple of days before the Logjam Report came up. Mozilla is disabling more and more weak Cipher and / or Key Combinations for quite a while now.

Firefox 38.0.5 (beta) is NOT safe

[jd smithers]

I am not fully up2date what Opera and Google are doing regarding SSL / TLS.

hi,

according to adam langley from google, chrome will include the necessary change in version 45, maybe with earlier backports.

cite: "This change is on track to be included in Chrome 45, although we may backport it to earlier release branches depending on how bad any breakage is."

regards

Posted via CB10