tesco security fail

heh

https://www.ssllabs.com/ssltest/analyze.html?d=tesco...

reported to them just now over phone, the contact us page is now actually completely blocked by both firefox and chrome.

In reply to a post by Chrysalis:

reported to them just now over phone, the contact us page is now actually completely blocked by both firefox and chrome.

https://www.tescohelp.com/tesco/forms/cs_form.html loads for me.

Chrome gives a yellow warning triangle in the padlock area because, like many sites, it still uses the sha1 algorithm which is deprecated. Should still work though.

I get this on FF

Secure Connection Failed

An error occurred during a connection to www.tescohelp.com. SSL received a weak ephemeral Diffie-Hellman key in Server Key Exchange handshake message. (Error code: ssl_error_weak_server_ephemeral_dh_key)

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.

I can't replicate it.

With Firefox: http://s23.postimg.org/6jpszbki3/ff_tesco.png

I get what bobble_bob gets on FF.

I do too now, FF is not my primary browser and it was at version 36.

sounds like your chrome isnt up to date.

what the deal with this security rubbish... I know FF and Chrome are having a [censored] about Flash and have done something... all I know is a lot of websites over the lat 2 day aren't displaying correctly..

Getting rather [censored] off with the Internet now!

the industry is in a co-ordinated push to modernise encryption security standards, firefox and chrome are doing this to push website administrators to update. Is it right they block without a user overide? its similar situation to the blocking of flash when no update is available, I think they should allow the user to still browse but they have to click an approve button and be warned of the reason for the block.

another large company behind is rockstar games, their gta5 social club site only allows rc4 ciphers.

Edited by Chrysalis (Thu 16-Jul-15 10:30:52)

My flash arent been blocked by FF yet. Although i do have "ask to activate" enabled so have to give permission to run when i want it to

For www.tescohelp.com I get a blank page on both FF38 & IE8.

I get the same as you for https://www.tescohelp.com/tesco/forms/cs_form.html .

But is it the correct URL for Tesco Help? Not http://www.tesco.com/help/ ?

In reply to a post by Chrysalis:

sounds like your chrome isnt up to date.

Yes, that is what I said.

In reply to a post by XRaySpeX:

But is it the correct URL for Tesco Help? Not http://www.tesco.com/help/ ?

http://www.tesco.com/help/contact/

Then click "Grocery team contact form".

luckily the guy on the phone was internet savvy so I explained exactly why it was instead of a vague fix your encryption, he said he wrote a detailed report for their tech team.

I do like how browsers are pushing websites into better security practices anyway. It may inconvenience users in the short term, but in the long term it creates a better internet.