SSL 2.0 vs. SSL 3.0
September 17, 2008 3:49 AM   Subscribe

I've been trying the Linux hack of the Google Chrome browser, and notice it uses SSL 2.0, as opposed to the SSL 3.0 that FF3 uses. A cursory check shows SSL 2.0 to be faster, but is it less secure than SSL 3.0? What are some other pros/cons about the two?
posted by Marisa Stole the Precious Thing to Computers & Internet (7 answers total) 1 user marked this as a favorite
Someone intercepting the initial message in an SSL2.0 handshake can force the server and client to agree to the weakest mutually supported encryption standard. So if you are connecting to servers that support 40 bit export-weakened encryption, and transmitting sensitive info, you could have trouble. Maybe you can disable 40/56 bit encryption in Chrome. I believe non-secure connections would then fail.
posted by BrotherCaine at 4:19 AM on September 17, 2008 [1 favorite]

Chrome (checked both the official windows version and the linux hack) does not use SSL 2.0 unless you have enabled it your self in the settings.

The only reason SSL 2.0 would be any faster than SSL 3.0/TLS 1.0 would be due to it not supporting all the security features of SSL 3.0/TLS 1.0.

There are no reason to use SSL 2.0 now as it has several serious known security weaknesses that SSL 3.0 and TLS 1.0 fixes. And SSL 3.0 has been out since 1996, so the chance that there are any old web servers out there not supporting SSL 3.0 are minimal.
posted by rpn at 4:32 AM on September 17, 2008 [2 favorites]

Chrome (checked both the official windows version and the linux hack) does not use SSL 2.0 unless you have enabled it your self in the settings.

If you go to Options and Under the Hood, there is the option to check SSL 2.0 - so you're right, you do have to choose it. But I'm still curious about security and other pros/cons, and I thank you for your POV with regards o that.
posted by Marisa Stole the Precious Thing at 4:37 AM on September 17, 2008

What IBM says:
SSL version 3.0 is an almost totally different protocol compared to SSL Version 2.0. Some of the major differences between the two protocols include:
  • SSL Version 3.0 handshake protocol flows are different than SSL Version 2.0 handshake flows.
  • SSL Version 3.0 uses the BSAFE 3.0 implementation from RSA Data Security, Incorporated. BSAFE 3.0 includes a number of timing attack fixes and the SHA-1 hashing algorithm. The SHA-1 hashing algorithm is considered to be more secure than the MD5 hashing algorithm. SHA-1 allows SSL Version 3.0 to support additional cipher suites which use SHA-1 instead of MD5.
  • SSL Version 3.0 protocol reduces man-in-the-middle (MITM) type of attacks from occurring during SSL handshake processing. In SSL Version 2.0, it was possible, though unlikely, that a MITM attack could accomplish cipher specification weakening. Weakening the cipher could allow an unauthorized person to break the SSL session key.
posted by smackfu at 5:31 AM on September 17, 2008

Cons: SSL 2 is weaker in several significant ways.

Pros: SSL 2 has no pros and should not be used. That's precisely why it's off by default in every modern SSL application. Do not turn it on unless you know why you're turning it on. If you have to ask why you would turn it on, you do not have a reason to do so.

" uses SSL 2.0, as opposed to the SSL 3.0 that FF3 uses."

Once again, this simply isn't true. It supports SSL 2 only when the protocol is enabled, which is exactly the same as Firefox, not in contrast to it. (See the pref: security.enable_ssl2) The only difference is that while the Mozilla folks have -- after some number of years of having it -- decided to hide the pref to enable SSL 2 in the UI, the Google folks have elected not to hide it for some reason.
posted by majick at 7:21 AM on September 17, 2008

The only possible reason I could see to using SSL 2.0 is if the WINE implementation of Chrome is using the schannel dll (via secur32), and there is some bug related to using SSL 3.0 in that DLL. Did you check the box to enable 2.0, or was it set that way by default when you installed? The windows version of Chrome has it unchecked.

When I worked in IT I often said that "bad security is worse than no security", I can't remember if I was quoting Bruce Schneier or not. Using a 10 year old deprecated security protocol is asking for trouble. The good guys probably don't prioritize it anymore, but exploits may still be valuable to malware writers and identity thieves.
posted by BrotherCaine at 8:57 AM on September 17, 2008

Wow, thanks everyone. I think I can safely say this question is answered.
posted by Marisa Stole the Precious Thing at 10:23 AM on September 17, 2008

« Older Why brake fluid?   |   When to seek help for anemia Newer »
This thread is closed to new comments.