Notice WTF.com now supports SSL!

[Jason]

Hey guys,

Just a quick note that we're now testing an SSL connection for enhanced security while visiting our site...

Please let me know if you do not receive the "lock" symbol (or the equivalent in your particular browser), or are forwarded anywhere other than: https://www.wtf.com

 

[Swah]

Works for me:


The latest Chrome on Win 10.

 

[BrIONwoshMunky]

I get a warm fuzzy feels when my internet tubes are protected. Thanks @Jason!

 

[BudVugger]

they can't steal me nudez

 

[BRiT]

they can't steal me nudez

It's not stealing when you publicly plaster them up everywhere.

 

[Jung]

Awesome. You should turn off RC4 though.

https://tools.ietf.org/html/rfc7465
https://community.qualys.com/thread/14956

 

[Jason]

Awesome. You should turn off RC4 though.

https://tools.ietf.org/html/rfc7465
https://community.qualys.com/thread/14956

Thanks! I took care of that. We went from a rating of B to a rating of A-!

 

[BRiT]

Thanks! I took care of that. We went from a rating of B to a rating of A-!

What's needed for an A+?

I know what my answer is when I'm on the answering side, but I think this is a different sort of question...

 

[Jason]

What's needed for an A+?

I know what my answer is when I'm on the answering side, but I think this is a different sort of question...

I'd have to swallow!

 

[BRiT]

I'd have to swallow!

So the answer is the same regardless of the question context.

 

[Jung]

https://blog.qualys.com/ssllabs/2013/06/25/ssl-labs-deploying-forward-secrecy

 

[Jason]

https://blog.qualys.com/ssllabs/2013/06/25/ssl-labs-deploying-forward-secrecy

I was just reading about that...

I have most of the required ciphers/parameters, but its not identical to a few that are getting a full A so I'll have to experiment with the parameters.

Some of the ideal parameters are contained in posts from 2014 or so, so want to make sure whatever I'm using is also up to date..

 

[BRiT]

@Jason run a new test against google.com and look to see what they have listed as preferred. Seems we're close, just that we don't have them listed in preferred order.

Compare it against this one: https://www.ssllabs.com/ssltest/analyze.html?d=www.google.com&s=172.217.6.68&hideResults=on

 

[Jung]

If you have everything ordered correctly try disabling DES-CBC3 ciphers.

 

[BRiT]

Todo Note for myself: https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization

Ticket opened with DNS Host asking when they'll allow for DNS CAA records.

I really wish they'd allow me to drop down to raw edit mode. The zone files are cake to edit, but I'm stuck in their suck interface.

 

[Jason]

https://blog.qualys.com/ssllabs/2013/06/25/ssl-labs-deploying-forward-secrecy

BRiT and I were at this one for an hour! lol

A+ rated now! Boo-yah!

 

[MisterFister]

I'm going to get excited about this as soon as I learn what SSL is.

 

[RebelBuddha]

What version are you running and are you aware of Heartbleed?

 

[Jason]

What version are you running and are you aware of Heartbleed?

I don't want to get too detailed with specifics in a public thread obviously, but yes we're aware of Heartbleed.

 

[MaxPower]

Todo Note for myself: https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization

Ticket opened with DNS Host asking when they'll allow for DNS CAA records.

I really wish they'd allow me to drop down to raw edit mode. The zone files are cake to edit, but I'm stuck in their suck interface.

Dude, you're over thinking this. Think outside the box. Just use WinZip. You can edit CNAME & MX records. Bulk edits. You can even TARball the internet....Simple.