I have no idea what I'm looking at. Do I need to enter a domain name some place? What domain is this telling me about? I scroll to the bottom of the page, it's telling me what browser and OS I'm on ... ok, maybe this page is showing me how bad my browser is at SSL?
Oh, these things are clickable. "This pages contains a lone password field not wrapped in a <form> tag." Um ... yeah? Oh, you're saying that my browser renders that and it probably shouldn't.
dh2048 is green let's click that. "dh2048.badssl.com uses an unsupported protocol. ERR_SSL_OBSOLETE_CIPHER"
Alright, I give up. I have no idea what I'm looking at.
Edited to add:
If this site is reporting issues with my browser, why does it seem to say that Chrome supports dh2048 (this item is green on the page) but then following the link the browser complains that it's unsupported? Either the point of this site is not obvious, or it cannot be trusted to know the right things about my browser.
To clarify: this doesn't show what's supported and what's not, that's for you to find out by clicking things. It shows things in green that are generally considered secure. For example, 2048-bit finite-field ephemeral Diffie-Hellman (that's dh2048.badssl.com) is generally still considered secure, but Chrome doesn't allow it, so that's why you get that error even though the website shows it as green.
Chrome does so for tangentially related, mostly-fine reasons. Generally dh2048 doesn't really exist on much of the Internet: because clients that don't do ECHDE (only DHE) are also generally limited to 1024-bit FFDH. That's not as good (not totally busted, but not great either). Anything that does 2048 bit FFDH probably also does ECDHE, and ECDHE is much better from a performance perspective and marginally better from a security perspective.
The best classical attacks put P-256 at about 128 bits of security, and 2048 bit FF at about 112. Neither is problematic at present. FFDH has some other problems: because the other peer communicates the field over which you're going to work, a poorly configured or malicious peer could pick a bad field or a small subgroup. (That's a little esoteric, but since there's no good reason to keep it around anyway....)
> badssl.com is meant for manual testing of security UI in web clients.
And my understanding is that green things are things that are good (security wise), red is bad. You'll have to test yourself if they work with your browser.
Took me a little while to understand as well but it's supposed to test your client. You browser should be able to display the green links without errors and should refuse to navigate to the red ones since they are insecure for one reason or an other (weak algorithms, broken SSL etc...)
That's mostly correct, except for some definitions of "should". Chrome connects to the Mozilla "Old" config, which is fine. The "Old" config does not mean "only old/bad ciphersuites", it means: "support old/bad clients". Chrome negotiates AES128GCM with ECDHE on my desktop, so it is rightfully pretty happy.
Meanwhile, while 2048 bit FFDH is considered safe, Chrome refuses to connect to it, for reasons that I've elaborated on elsewhere in the thread.
Given what you say - what's the point of this website? After all, a safe client should connect to green things (but might not support everything, fine), and... should also connect to many red things (if they're actually safe).
If you're interested in figuring out what's wrong with TLS configuration on your site, SSLLabs is a much more useful tool. This is for checking if an SSL client (like your browser, but also e.g. a command line tool) is doing something bad.
I'm not being facetious. I'm narrating a user experience. One that still leaves me with a lack of understanding about the purpose of this site. Considering the ranking my comment received, a fair number of other HN readers agree that this site has terrible usability. Early comments addressing the use of the site made guesses that are apparently wrong. I say "apparently" because by now there are quite a few comments clarifying the intent of the site. That intent is not communicated by the site itself.
Chrome tells me dh2048 is "unsupported." If the site says "this is good" and Chrome says it's "unsupported" but then Chrome displays an error code indicating "obsolete," I can't tell who's wrong here. Either Chrome's developers chose the wrong error code, or badssl.com is recommending an "obsolete" algorithm which sounds bad (why would it be obsolete if it's good?) The site taught me nothing.
Maybe the site wasn't intended for a wider audience. (I've see corporate training contracting companies set up similar sites for their students: it is in no way obvious what the intent is unless you have sat through their class.) But it's been linked on a discussion site with a wider audience. Maybe it's a valuable resource, but without an explanation, it's just another website with bad UX.
There seems to be an attitude that appears in tech crowds often enough: well I know what this is, how could you possibly misunderstand? They forget that other humans, with other perspectives and other experiences than their own would lack the context that makes things "make sense." They fail to see through the eyes of someone different. It's bad for user experience. That doesn't mean everything should be designed for everyone. Maybe badssl.com serves its audience well. Maybe it's not intended for a "wider audience." And that's OK.
I have no idea about the extent of gp's knowledge on subject, but I came to the comments section with similar feeling. I literally had no idea what this site is about, what it does, how I can use it...
Even now that some comments have clarified some of this questions I still find the UI confusing and colors simply insane.
This page isn't trying to sell you a product. I get that you're trying to give constructive feedback but if you don't know what you're looking at here, you can just ignore it and move on.
At best the submission title could use an edit so it's clearer what it is, that you don't have to click to ignore it.
Oh, these things are clickable. "This pages contains a lone password field not wrapped in a <form> tag." Um ... yeah? Oh, you're saying that my browser renders that and it probably shouldn't.
dh2048 is green let's click that. "dh2048.badssl.com uses an unsupported protocol. ERR_SSL_OBSOLETE_CIPHER"
Alright, I give up. I have no idea what I'm looking at.
Edited to add: If this site is reporting issues with my browser, why does it seem to say that Chrome supports dh2048 (this item is green on the page) but then following the link the browser complains that it's unsupported? Either the point of this site is not obvious, or it cannot be trusted to know the right things about my browser.