On 11/19/2021 9:59 PM, Steve Hayes wrote:
> On Fri, 19 Nov 2021 16:17:49 -0000, "Apd" <not@all.invalid> wrote:
>
>> Depending on how old your FF is, it may not support the encryption
>> algorithm the site wants to use. No amount of updated certs will help
>> with that and FF won't be able to override. It might be useful if you
>> could note here which URLs are giving trouble and what version of FF
>> you're using.
>
> One that none of my browsers will override is
>
> http://www.oca.org
>
> Firefox reports an expired certificate, and won't override.
>
> Maxthon reports that Avast has blocked it.
>
> Opera does something similar.
>
> Firefox 41 still gets me into Google & Wordpress, and most pages of
> GoodReads, other than book description pages, which won't display
> properly.

Sent this link:

https://www.ssllabs.com/ssltest/analyze.html?d=www.oca.org

Five minutes later, the report, a part of which is...

https://www.ssllabs.com/ssltest/analyze.html?d=www.oca.org&s=45.79.144.159 <=== returned result

Mozilla (but the Windows entry is the same)

Path #1: Trusted
1 Sent by server oca.org
Fingerprint SHA256: a72baf3558270f9629b28f5beda73defc54ceddc54d5237ae6b9064644e57cb4
Pin SHA256: I3N6VhKN9Hxzh6f1I2Kq6ZZBtYGbdhMLiED3t8u7NLs=
RSA 2048 bits (e 65537) / SHA256withRSA
2 Sent by server R3
Fingerprint SHA256: 67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd
Pin SHA256: jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0=
RSA 2048 bits (e 65537) / SHA256withRSA
3 In trust store ISRG Root X1 Self-signed
Fingerprint SHA256: 96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
Pin SHA256: C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHFr8M=
RSA 4096 bits (e 65537) / SHA256withRSA

Path #2: Not trusted (invalid certificate [Fingerprint SHA256:
0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739])
1 Sent by server oca.org
Fingerprint SHA256: a72baf3558270f9629b28f5beda73defc54ceddc54d5237ae6b9064644e57cb4
Pin SHA256: I3N6VhKN9Hxzh6f1I2Kq6ZZBtYGbdhMLiED3t8u7NLs=
RSA 2048 bits (e 65537) / SHA256withRSA
2 Sent by server R3
Fingerprint SHA256: 67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd
Pin SHA256: jQJTbIh0grw0/1TkHSumWb+Fs0Ggogr621gT3PvPKG0=
RSA 2048 bits (e 65537) / SHA256withRSA
3 Sent by server ISRG Root X1
Fingerprint SHA256: 6d99fb265eb1c5b3744765fcbc648f3cd8e1bffafdc4c2f99b9d47cf7ff1c24f
Pin SHA256: C5+lpZ7tcVwmwQIMcRtPbsQtWLABXhQzejna0wHFr8M=
RSA 4096 bits (e 65537) / SHA256withRSA
4 In trust store DST Root CA X3 Self-signed
Fingerprint SHA256: 0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739
Pin SHA256: Vjs8r4z+80wjNcr1YKepWQboSIRi63WsWXhIMN+eWys=
RSA 2048 bits (e 65537) / SHA1withRSA
Valid until: Thu, 30 Sep 2021 14:01:15 UTC
EXPIRED
Weak or insecure signature, but no impact on root certificate

Which sure looks like the handiwork of LetsEncrypt certificate scheme.
Even though their name isn't mentioned in the listing. I think the
ISRG Root is theirs.

The site gets a grade of "B" because it supports TLS 1.0 and TLS 1.1,
as well as the others. At least it cuts off SSL2 and SSL3. The expired
certificate likely doesn't modify the rating.

Paul

"Steve Hayes" wrote:
> One that none of my browsers will override is
>
> http://www.oca.org
>
> Firefox reports an expired certificate, and won't override.

The site is using certs from LetsEncrypt and there were problems with
them recently. The ones they present to my FF 52.9 are ok. In Paul's
report there is mention of DST Root CA X3 which is now expired. Your
browser should not be trying to use that.

Your browser should be using updated certs from ISRG (LetsEncrypt);
in particular, these should do the job:

- ISRG Root X1 (Self-signed)
- Let's Encrypt R3 (Signed by ISRG Root X1)

Get them from: <https://letsencrypt.org/certificates/> and install
into Firefox. You may also want to install them in WinXP.

> Maxthon reports that Avast has blocked it.
>
> Opera does something similar.

They would also need updating. I don't know if they use in-browser
certs like Firefox or the system ones.

> Firefox 41 still gets me into Google & Wordpress, and most pages of
> GoodReads, other than book description pages, which won't display
> properly.

The most recent Firefox which runs on XP is 52.9 and I don't recall
needing to update its certs.

"Steve Hayes" <hayesstw@telkomsa.net> wrote

| One that none of my browsers will override is
| | http://www.oca.org

Like Apd, it works fine for me in FF 52.9. Why not
update? I know they broke a lot of things, but there
are extensions.

The site is an unholy mess, I must say, for a Christian
organization. :) But that's not uncommon these days.

I'm still having a hard time figuring out why so many
sites are mostly covered with gray in FF. I have to disable
CSS to see them. In some cases it seems to be a deliberate
attempt to block people who don't enable script. They
just plop a full-window DIV with a high z-order on top of
the page, which script then removes. I've been
able to cure some problems by blocking display of those
classes in userContent.css. This particulat site looks like
it's the usual pile-of-crap overuse of script by people using
templates and script snippets who don't know what they're
doing. But the really odd thing is that in IE6 without script
it actually doesn't look too bad!

On Fri, 19 Nov 2021 at 16:17:49, Apd <not@all.invalid> wrote (my
responses usually follow points raised):
>"J. P. Gilliver (John)" wrote:
>> On Mon, 15 Nov 2021 at 08:26:48, Mayayana wrote:
>>>I updated mine according to this webpage:
>>>
>>><https://msfn.org/board/topic/175170-root-certificates-and-revoked-cer
>>>tificates-for-windows-xp/>
>> []
>> Will that help with a very old Firefox running on W7?
>
>No. FF has its own cert store.

I thought I'd read that, so feared as much.
>
>> I get quite a lot of cases where I have to accept the exception (or
>> something like that) but then it works; in (I think it is) the last
>> week or two, I've had a few that just won't connect, and don't give
>> me the option to override the warning.
>
>Depending on how old your FF is, it may not support the encryption
>algorithm the site wants to use. No amount of updated certs will help
>with that and FF won't be able to override. It might be useful if you
>could note here which URLs are giving trouble and what version of FF
>you're using.
>
27.0.1 (which was old even under XP). I'm not worried - I use Chrome
(up-to-date, at least fairly; I'm on Windows 7) for anything FF won't
handle. I just like the UI of this old Firefox, and also on the pages
that _do_ work with it, I think they work faster, though couldn't prove
that. Certainly the equally old version of the DownloadHelper extension
works - and without the slowdown a certain video hosting site has
recently started imposing, too.
>
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

<This space unintentionally left blank>.

On Sat, 20 Nov 2021 08:56:03 -0500, "Mayayana"
<mayayana@invalid.nospam> wrote:

>"Steve Hayes" <hayesstw@telkomsa.net> wrote
>
>| One that none of my browsers will override is
>|
>| http://www.oca.org
>
> Like Apd, it works fine for me in FF 52.9. Why not
>update? I know they broke a lot of things, but there
>are extensions.

I was using it, but upgrade to v 41, the bersions before pockets. I
don't want to have to go away and read a chapter of a book while
waiting for a web page to load.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

"Steve Hayes" <hayesstw@telkomsa.net> wrote

| > Like Apd, it works fine for me in FF 52.9. Why not
| >update? I know they broke a lot of things, but there
| >are extensions.
| | I was using it, but upgrade to v 41, the bersions before pockets. I
| don't want to have to go away and read a chapter of a book while
| waiting for a web page to load.
|

Weird. I never heard of pockets. I had to look it
up. Maybe that was the icon that looks like a few
books, on the toolbar? There are some nonsense
things I always remove, but I never noticed pockets
before. It turns out I had it "enabled", whatever
that means. :)

Firefox is certainly slow and bloated. I like New Moon,
Pale Moon, or Waterfox better. But once FF is started I
find pages generally load instantly. However, I also customize.
I use NoScript to block all script unless I really need it.
I use a HOSTS file to block spyware and ads from 3rd
parties. I don't allow videos to load. I block all prefetching...
So Firefox only needs to load an actual webpage, not 4
MB of javascript software and 19MB of MP4s. I'm still
surprised when I see someone else's computer, with things
jumping all around on webpages. For me, if a webpage
doesn't sit still then something needs to be fixed. But
it's an ongoing battle. Fools who love trinkets are forever
trying to jazz up their pages. I've needed to block CSS display
of :before, :after, transform and animation, in order to block
such things as logos dripping fluorescent green and slideshows
on speed.

Lawrence Aracabia <LawrenceAracabia@Aracabia.com> wrote:

> Someone gave me a Windows XP 5.1.2600 laptop that works fine when
> booting but I can't yet find a browser for it that will connect to
> the Interbnet.
>
> ...
>
> My two main questions are really a result of the first problem.
> (1) How can I get a web browser for that WinXP that works on the
> Internet?
> (2) ...

You give no details of what qualifies as no access to the Internet.
Have you tried connecting your web browsers to your router (whether a
separate device, or built into a cable modem)? The router has its own
internal web server to let you configure it. You may find you can
connect to intranet hosts, like the web browser built into the router,
but not to Internet hosts.

Other than web browser, have you tried any other network-capable client
to see if you can get Internet access? Have you tried opening a command
shell, and tried either pinging a web site or doing a tracerout to it?

ping www.intel.com
tracert www.intel.com

You don't mention if you tried to connect to both HTTP-only and HTTPS
web sites, or have only tried to connect to HTTPS web sites. No mention
of where you tried to connect. What are the FQDN (fully qualified
domain name), including the protocol (HTTP or HTTPS), to where you have
tried to connect?

Is Internet access paid by you, or by your parents, your employer, or
someone else? If someone else is managing the network setup, could be
they configured the router with its firewall, or another upstream
firewall, as to which devices can connect to it. For example, routers
can often be configured to allow only certain devices by MAC address to
connect to it. Since the computer is new to your network, could be it
was not added to the MAC list of devices allowed to connect to the
router. Can you connect from your host via web browser to the internal
web server in the router? Mine only uses HTTP, so I cannot use it to
ensure HTTPS is working okay from my host. It does let me see if basic
networking via HTTP is working, though. If the router is separate of
your DSL/cable modem, you could bypass the router by disconnecting it
from the DSL/cable modem, and plugging your computer directly to a LAN
port on the DSL/cable modem using a wired connection (while also
bypassing any wifi issues).

Does your router support both IPv4 and IPv6? Some old ones don't
support IPv6. The sites you may trying to connect may only support
IPv6; that is, they have no IPv4 address. We don't know to where you
tried to connect. Also, routers that support both IPv4 and IPv6 may
have different security settings for each addressing method.

Lots of sites are dropping support for old versions of Firefox. The
latest you can get for Windows XP is Firefox 52ESR. You can alter the
UA (User Agent) string the web client sends to the server, but that
won't magically change the web browser to support later features
demanded by many web sites. The old version of Firefox is also not
maintained. You might look into using MyPal. While it was forked off
of Pale Moon which was forked off an old version (pre-52ESR aka
pre-Quantum) of Firefox, it is maintained.

Do you use an anti-virus or other anti-malware program? If so, many
will intercept your web traffic to interrogate its content for malicious
content. With HTTP, it simply operates as a transparent proxy.
However, for HTTPS, a proxy cannot decrypt the encrypted traffic to look
at its content. To do that, AVs use the MITM (Man-In-The-Middle)
hacking trick. The install a root certificate into the global OS
certificate store (in Windows, run certmgr.msc), but they have to also
insert their certificate into Firefox's private certificate store (in
Firefox's, go to about:preferences#privacy -> View Certificates). I've
not found Mozilla explain why they want to wrest cert control away from
the OS to provide their own private cert store. If the AV's cert
doesn't install in Firefox, there is no cert to use with the MITM scheme
where the web browser uses HTTPS to connect to the AV's proxy using the
installed AV's certificate (to do the encryption from proxy to web
client) and to do HTTPS to the server (encryption from proxy to server).
The proxy does HTTPS at both endpoints (web client and server), but
internally the HTTPS traffic gets decrypted, so the AV can inspect the
web traffic.

If the AV's cert doesn't get installed into Firefox, the AV's proxy
cannot do HTTPS using MITM to both the web client and to the server. If
their certificate expires (one of the reasons you need to keep the AV
updated), it cannot be used by the AV's proxy. In either case, the AV
proxy will allow HTTP connects (because no cert is needed for MITM), but
cannot do HTTPS (cert is missing or expired or invalid). You'll find
other web browsers can connect to HTTPS sites, because they use the OS
global cert store (that the AV added when it was installed or updated).
Firefox fails on HTTPS sites when the AV's cert is missing, expired, or
invalid for the copy installed into Firefox's private cert store.

The AV /should/ provide a means to reinstall their cert into Firefox's
private cert store. Alas, not all do, so the only way to fix the
problem is uninstall and reinstall the AV.

I use a stream capture program that uses the MITM scheme, and it
installs their cert into both the OS global cert store (to use with
non-Mozilla web browsers) and their cert into Firefox's private cert
store. When Firefox can no longer connect to HTTPS sites, the software
has an option to reinstall their cert into Firefox's private cert store,
and HTTPS connections work again. One time was due to a change in how
certs can be specified for multiple domains, so the old cert became
invalid, and I had to get a new one. Another time their cert had
expired, so I had to get a new one. Without their cert (in the OS
global cert store for non-Mozilla web browsers, or in Firefox's internal
cert store), the encrypted web traffic cannot be interrogated by the
local proxy doing the capture. I could capture videos from HTTP sites,
but there none that I know of with video content that are HTTP, so most
video content is from HTTPS sites, and where MITM is required to capture
the videos (or to find from that content where are the video sources to
capture from there).

AV's and video stream capture software aren't the only programs that use
the MITM scheme to interrogate HTTPS traffic. However, if their cert is
lost, never installed, expires, or becomes invalid, you can no longer
connect to HTTPS sites. In fact, your web client can't even connect via
HTTPS to their local transparent proxy.

You hint at trying multiple web browsers, but don't mention which.
Since Firefox uses its own private (internal) cert store, so do the
variants of Firefox. Which *non-Mozilla* web browsers have you tried?
Non-Mozilla web browsers (e.g., Internet Explorer, Chrome) use the OS
global cert store.

Without details, responses will be as unfocused as your post is vague.

I did not address the wifi issues since that is a separate topic, and
should be discussed in a separate thread. Besides, the details
regarding your phone and wifi setup are just as vague. I don't know
what you consider a typical wifi hotspot. Many require login to use
them, some are private, and some may require later wifi protocols than
your hardware supports.

On 11/21/2021 5:13 PM, VanguardLH wrote:
> Lawrence Aracabia <LawrenceAracabia@Aracabia.com> wrote:
>
>> Someone gave me a Windows XP 5.1.2600 laptop that works fine when
>> booting but I can't yet find a browser for it that will connect to
>> the Interbnet.
>>
>> ...
>>
>> My two main questions are really a result of the first problem.
>> (1) How can I get a web browser for that WinXP that works on the
>> Internet?
>> (2) ...
>
> You give no details of what qualifies as no access to the Internet.

This corresponds to the mass dropout of https-only sites,
after the recent LetsEncrypt incident. Users view what
they are seeing as "no access to Internet". Which is a fair
description, when suddenly nothing works and you don't know why.

This is not a "ping" style issue, it's a certificate issue
for https usage. And the "HTTPS Everywhere" campaign has
caused a large outage for WinXP users, who are badly in
need of a browser that runs on WinXP and has an up-to-date
certificate store.

There are two levels of issues. Manual repair of a certificate
store, following the instructions on the LetsEncrypt site.

But HTTPS is more than certificates, it's also crypto
algorithms, such as CHACHA20. You can fail to connect
to some sites, because of their fairly picky choice of
crypto. I ran into one site, with TLS 1.3 and only two
crypto choices. A "highest class possible" site,
prepared by some paranoid person. The content on the site,
did not need this, it was a kind of showing off I would guess.

# Analyze a web site, for characteristics. Takes five minutes or less.
# Be patient. Attach the IP as the end argument, as shown.

https://www.ssllabs.com/ssltest/analyze.html?d=www.some.com

# Display the characteristics of the browser, whether you left
# SSL switched on when it should be off. Only TLS should be used.
# This URL never needs to be edited, just plop and use.

https://www.ssllabs.com/ssltest/viewMyClient.html

It you have a traditional failure, it shows in the tray,
as a different icon.

Paul

On Sun, 21 Nov 2021 08:29:26 -0500, "Mayayana"
<mayayana@invalid.nospam> wrote:

>"Steve Hayes" <hayesstw@telkomsa.net> wrote
>
>| > Like Apd, it works fine for me in FF 52.9. Why not
>| >update? I know they broke a lot of things, but there
>| >are extensions.
>|
>| I was using it, but upgrade to v 41, the bersions before pockets. I
>| don't want to have to go away and read a chapter of a book while
>| waiting for a web page to load.
>|
>
> Weird. I never heard of pockets. I had to look it
>up. Maybe that was the icon that looks like a few
>books, on the toolbar? There are some nonsense
>things I always remove, but I never noticed pockets
>before. It turns out I had it "enabled", whatever
>that means. :)
>
> Firefox is certainly slow and bloated. I like New Moon,
>Pale Moon, or Waterfox better. But once FF is started I
>find pages generally load instantly. However, I also customize.
>I use NoScript to block all script unless I really need it.

Yes, NoScript is the main reason that I still have a version of
Firefox on my computer, and perfer to use it for visiting sites
previously unknown to me, until I know that they can be trusted. I
often make use of the "temporarily allow" feature.

Another thing I like about Firefox with NoScript is that it has the
"Allow cookes for session only" thing, which seems to avoid the "We
value your privacy" messwages.

>I use a HOSTS file to block spyware and ads from 3rd
>parties. I don't allow videos to load. I block all prefetching...
>So Firefox only needs to load an actual webpage, not 4
>MB of javascript software and 19MB of MP4s. I'm still
>surprised when I see someone else's computer, with things
>jumping all around on webpages. For me, if a webpage
>doesn't sit still then something needs to be fixed.

Agreed.

--
Steve Hayes from Tshwane, South Africa
Web: http://www.khanya.org.za/stevesig.htm
Blog: http://khanya.wordpress.com
E-mail - see web page, or parse: shayes at dunelm full stop org full stop uk

On 11/21/2021 7:23 PM, Paul wrote:
>the "HTTPS Everywhere" campaign TLS should be used.

Paul:

I knmow what you mean about HTTPS everywhere.

A local radio station offers a streaming service as well as an FM signal. They
recently changed their streaming link to an HTTPS link. I was using an old 486
pc as a music server running Windows 98se and Winamp 5.35 wired into my amp and
end table speakers. The new link;

https://pubmusic.streamguys1.com/wzum-aac

Would not work on Windows 98se but would work on XP. I edited the link to;

http://pubmusic.streamguys1.com/wzum-aac

And 98se worked just fine.

All of which made me wonder just what the point was of using an encrypted link
for something they are giving away for free and even broadcasting!!

Beam me up Scotty! There is not enough intelligent life down here to bother with.

John

--
\\\||///
------------------o000----(o)(o)----000o----------------
----------------------------()--------------------------
'' Madness takes its toll - Please have exact change. ''