From 7ee1aa890ea3a9d45a84b4228a85abc44a06ad6c Mon Sep 17 00:00:00 2001 From: yokoffing <11689349+yokoffing@users.noreply.github.com> Date: Wed, 11 Oct 2023 15:53:05 -0400 Subject: [PATCH] Updated Optional Hardening (markdown) --- Optional-Hardening.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Optional-Hardening.md b/Optional-Hardening.md index 35742b2..138b83d 100644 --- a/Optional-Hardening.md +++ b/Optional-Hardening.md @@ -179,11 +179,11 @@ user_pref("network.dns.skipTRR-when-parental-control-enabled", false); *** -### Require Safe Negotiation +### Require Secure Renegotiation -Block connections to servers that don't support [RFC 5746](https://datatracker.ietf.org/doc/html/rfc5746) as they're potentially [vulnerable](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555) to a man-in-the-middle attack. +Block connections to servers that do not support RFC 5746, as they are potentially [vulnerable](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555) to man-in-the-middle attacks. -A server without RFC 5746 can be safe from the attack if it disables renegotiations. However, the problem is that the browser can't know that. Setting this pref to `true` is the only way for the browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server. +A server without [RFC 5746](https://datatracker.ietf.org/doc/html/rfc5746) can be safe from the attack if it disables renegotiations. However, the browser cannot know that. Setting this pref to `true` is the only way for the browser to ensure no unsafe renegotiations occur between the browser itself and the server. :warning: Some sites, like `EA.com`, will not let you login due to their weak encryption.