Re: [TLS] The TLS_FALLBACK_SCSV time bomb

[Florian Weimer <[e-mail]>]

* Andrei Popov:

> Yes, there is some truth in what you say. Downgrade-SCSV is a hack,
> but it will be hard/impossible to convince browser vendors to stop
> doing fallbacks. Perhaps that's because browsers compete on
> interoperability and connectivity, not security?

There's some discussion about disabling fallback in this Mozilla bug,
but I don't know it will turn out because I'm not familiar with
Mozilla's processes:

  <https://bugzilla.mozilla.org/show_bug.cgi?id=1084025>

What's odd is that competing on interoperability should also prevent
other useful security enhancements, but it does not happen
consistently: disabling MD5 in certificates, minimum RSA key sizes,
stricter Same-Origin Policy enforcement, click-to-play, and, more
recently, disabling SSL 3.0 by default (only announced by Mozilla so
far).  So it appears that failure-inducing security improvements are
completely off the table simply because vendors fear that users will
just switch to a browser that happens to work.