Last modified: 2012-02-22 12:41:32 UTC
SSL BROKEN!!! Connection either partially encrypted or SSL completely broken Do not trust this connection. ... I applaud your use of secure web pages. However, the security is deeply broken. Eg(S): https://secure.wikimedia.org/wikipedia/en/wiki/Advanced_Encryption_Standard And Generally: https://wikimedia.org/*.* (except https://bugzilla.wikimedia.org)which gets an 88%rating due to using an 1024 bit SHA-1 hash instead of 2048 BIT but doing everything else well! Calomel.org brings up 40% Insecure connection! Connection either partially encrypted or completely broken Do not trust this connection. ... Calomel has a tool for Firefox that makes useful suggestions about what a site needs to be more secure. @ calomel.org or thru the Firefox add-ons page. mozilla Brings up the following warning(s) You have requested an encrypted page that contains some unencrypted information. Information that you see or enter on this page could easily be read by a third party. ... OK? I do not really know the calomel folk however their "are you human?" (CAPTCHA)requires solving an rot-13 message!(if you wish to contact them!) (I would love to see a web page filled with cumulative ratings from the Calomel tool! But that would be WP:NOR!)
Secure is a known buggy hack It isn't in any way supported by the Operations team, other than rebooting the server or fixing it when it dies. If you look, there are lods of related bugs see bug 27946 etc
Marking as INVALID and moving to Wikimedia out of Security, since it's not a real "zomg secret" security issue, since this is really a submission of several known bugs. As pointed out in comment #1, a lot of this is already covered by the bug 27946 tracker. The *major* problem with our secure setup as-is is mixed content. This is all on the table to be fixed in the near future. The only bug that I really see here that I don't see mentioned elsewhere is the suggestion for 2048 bit instead of 1024 bit SHA1.
