❌ Software Removal | Frendica #2355

New Issue

2021-06-23T10:15:27Z

ghost commented

2021-06-23 10:15:27 +00:00

(Migrated from github.com)

Description

I propose the removal of Frendica.

Why I am making the suggestion

The Frendica website does not support AEAD Cipher.
This means that the website cannot be viewed securely.
https://friendi.ca/

My connection with the software

No connection

I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.

## Description I propose the removal of Frendica. ## Why I am making the suggestion The Frendica website does not support AEAD Cipher. This means that the website cannot be viewed securely. https://friendi.ca/ ## My connection with the software No connection - [x] I will keep the issue up-to-date if something I have said changes or I remember a connection with the software.

samuel-lucas6 commented

2021-06-23 10:45:11 +00:00

(Migrated from github.com)

The website uses HTTPS, so it seems that it can be viewed securely.

Edit: I should have been more specific in my initial reply. Not supporting AEADs does not immediately make things insecure. AES-CBC + HMAC is a common combination that is secure when implemented correctly and still widely used. In fact, using HMAC can actually lead to better security than using AEADs like AES-GCM. The TLS version is what's important here, and the website is using TLS 1.2 in most cases, which is fine (please see my later reply).

The website uses HTTPS, so it seems that it can be viewed securely. Edit: I should have been more specific in my initial reply. Not supporting AEADs does not immediately make things insecure. AES-CBC + HMAC is a common combination that is secure when implemented correctly and still widely used. In fact, using HMAC can actually lead to better security than using AEADs like AES-GCM. The TLS version is what's important here, and the website is using TLS 1.2 in most cases, which is fine (please see my later reply).

rusty-snake commented

2021-06-23 10:52:13 +00:00

(Migrated from github.com)

I tried 6 server from https://dir.friendica.social/servers and ALL supported TLS 1.3.

TLS 1.3 spec:

Those that remain are all Authenticated Encryption with Associated Data (AEAD) algorithms.

I tried 6 server from https://dir.friendica.social/servers and ALL supported TLS 1.3. [TLS 1.3 spec](https://datatracker.ietf.org/doc/html/rfc8446): > Those that remain are all Authenticated Encryption with Associated Data (AEAD) algorithms.

👍 1

ghost commented

2021-06-23 11:22:41 +00:00

(Migrated from github.com)

https://www.ssllabs.com/ssltest/analyze.html?d=friendi.ca&s=217.197.80.132

samuel-lucas6 commented

2021-06-23 11:44:32 +00:00

(Migrated from github.com)

https://www.ssllabs.com/ssltest/analyze.html?d=friendi.ca&s=217.197.80.132

It uses TLS 1.2 for me. It's really not great that it supports TLS 1.0 and 1.1 and doesn't support TLS 1.3, but TLS 1.2 is acceptable if configured properly and is still used by the majority of websites.

> > > https://www.ssllabs.com/ssltest/analyze.html?d=friendi.ca&s=217.197.80.132 It uses TLS 1.2 for me. It's really not great that it supports TLS 1.0 and 1.1 and doesn't support TLS 1.3, but TLS 1.2 is acceptable if configured properly and is still used by the majority of websites.

ghost commented

2021-06-23 12:00:24 +00:00

(Migrated from github.com)

https://www.ssllabs.com/ssltest/analyze.html?d=friendi.ca&s=217.197.80.132

It uses TLS 1.2 for me. It's really not great that it supports TLS 1.0 and 1.1 and doesn't support TLS 1.3, but TLS 1.2 is acceptable if configured properly and is still used by the majority of websites.

Why do you keep going off topic?
I have a problem with the lack of AES-GCM (or Chacha20) in the cipher list.
I don't see the TLS version as a problem.

> > https://www.ssllabs.com/ssltest/analyze.html?d=friendi.ca&s=217.197.80.132 > > It uses TLS 1.2 for me. It's really not great that it supports TLS 1.0 and 1.1 and doesn't support TLS 1.3, but TLS 1.2 is acceptable if configured properly and is still used by the majority of websites. Why do you keep going off topic? I have a problem with the lack of AES-GCM (or Chacha20) in the cipher list. I don't see the TLS version as a problem.

ghost commented

2021-06-23 12:01:12 +00:00

(Migrated from github.com)

This server does not support Authenticated encryption (AEAD) cipher suites.

https://www.ssllabs.com/ssltest/analyze.html?d=friendi.ca&s=217.197.80.132

> This server does not support Authenticated encryption (AEAD) cipher suites. https://www.ssllabs.com/ssltest/analyze.html?d=friendi.ca&s=217.197.80.132

rusty-snake commented

2021-06-23 12:42:42 +00:00

(Migrated from github.com)

I have a problem with the lack of AES-GCM (or Chacha20) in the cipher list.
I don't see the TLS version as a problem.

The cipher list has to do with the TLS version.

TLS 1.0 / TLS 1.1: unsecure
TLS 1.2: secure/unsecure (AES-GCM/ChaCha20/... and legacy ciphers)
TLS 1.3: secure (only secure ciphers)

This server does not support Authenticated encryption (AEAD) cipher suites.

https://www.ssllabs.com/ssltest/analyze.html?d=friendi.ca&s=217.197.80.132

It's only their homepage. Login is done on other servers.

@cookiepanda1 did you contacted friendica?

> I have a problem with the lack of AES-GCM (or Chacha20) in the cipher list. I don't see the TLS version as a problem. The cipher list has to do with the TLS version. TLS 1.0 / TLS 1.1: unsecure TLS 1.2: secure/unsecure (AES-GCM/ChaCha20/... and legacy ciphers) TLS 1.3: secure (only secure ciphers) > > This server does not support Authenticated encryption (AEAD) cipher suites. > > https://www.ssllabs.com/ssltest/analyze.html?d=friendi.ca&s=217.197.80.132 It's only their homepage. Login is done on other servers. @cookiepanda1 did you contacted friendica?

👍 1

samuel-lucas6 commented

2021-07-05 09:28:57 +00:00

(Migrated from github.com)

@freddy-m I believe this issue can be closed.

👍 1

This repo is archived. You cannot comment on issues.