<![CDATA[Any thoughts about the poodle SSL 3 bug?]]>This POODLE bites: exploiting the SSL 3.0 fallback

http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html

Mozilla says it will disable SSL 3.0 in Firefox 34 because of #Poodle vulnerability ow.ly/CLFgg

Should Opera disable SSL 3?

]]>https://forums.opera.com/topic/5674/any-thoughts-about-the-poodle-ssl-3-bugRSS for NodeWed, 15 Apr 2026 14:37:20 GMTWed, 15 Oct 2014 00:17:48 GMT60<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Thu, 16 Oct 2014 09:04:01 GMT]]>Thanks @l33t4opera.
It's always nice to be reassured that Opera is still on top of things when it comes to security.

]]>https://forums.opera.com/post/54342https://forums.opera.com/post/54342Thu, 16 Oct 2014 09:04:01 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 23:39:06 GMT]]>@l33t4opera I just read that blog post 🙂 & great myOpera rock smile 🙂

]]>https://forums.opera.com/post/54271https://forums.opera.com/post/54271Wed, 15 Oct 2014 23:39:06 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 17:44:16 GMT]]>Hi @chas4 @praetorianx @alexcavaco @fritzr @ra-mon @g00g00 @originalgbee @christoph142, FYI:

"What we have done in Opera 25, is to add a countermeasure to the SSLv3 protocol when used. Since the attack can only be done to SSL records of certain lengths, we simply split the records into several records, where none of the records can be attacked. Adam Langley from Google who helped out developing the details of this idea named the countermeasure “anti poodle record splitting”. Hopefully this will help keeping SSLv3 secure enough for a few more months, and give server owners a chance to upgrade to TLS.

Next we have removed the security badge for SSLv3 servers. This means that when you go to a SSLv3 server, it will look as you got to a standard unencrypted http server.

Opera also supports the TLS_FALLBACK_SCSV mechanism. This is a security feature, if supported by both browser and server, that effectively stops unwanted fallbacks to lower TLS versions. Sadly, this feature is not widely supposed yet, but we hope that Server administrators pay attention to this attack and will upgrade their servers to support it. This way, future problems with higher TLS versions will not have the same devastating effect." - form more details, please read the "Security changes in Opera 25; the poodle attacks" \m/

]]>https://forums.opera.com/post/54205https://forums.opera.com/post/54205Wed, 15 Oct 2014 17:44:16 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 16:50:38 GMT]]>FWIW, while disallowing downgrading of the connection from TLS to SSLv3 technically defeats the exploit in question, opera-developer still supports SSLv3 which is just a half measure. SSLv3 was deprecated over a decade ago. Opera should drop support.

]]>https://forums.opera.com/post/54194https://forums.opera.com/post/54194Wed, 15 Oct 2014 16:50:38 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 16:47:10 GMT]]>It fails the poodle test, Chromium and Firefox do not when configured not to use SSLv3.

]]>https://forums.opera.com/post/54192https://forums.opera.com/post/54192Wed, 15 Oct 2014 16:47:10 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 16:02:15 GMT]]>

opera-developer is vulnerable

No, it isn't.

]]>https://forums.opera.com/post/54188https://forums.opera.com/post/54188Wed, 15 Oct 2014 16:02:15 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 15:25:57 GMT]]>It appears that the --ssl-version-min argument is missing from opera-developer, so they must have removed it. So opera-developer is vulnerable and there is no way to fix that.

]]>https://forums.opera.com/post/54181https://forums.opera.com/post/54181Wed, 15 Oct 2014 15:25:57 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 14:49:29 GMT]]>Oh, yes, same as Chrome, I should have known :awww:

]]>https://forums.opera.com/post/54171https://forums.opera.com/post/54171Wed, 15 Oct 2014 14:49:29 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 13:42:48 GMT]]>

Hi,
Opera 12.16 with clean default profile, is shown as "Not vulnerable" to Poodle attack by the site www.poodletest.com/
http://âpp.com/Hfv5
SSLv3 is enabled by default in Opera 12.16 but after the test done, SSLv3 is automatically disabled.
I don't understand why.

Opera 26 seems "vulnerable" and i don't know how to disable SSL v3 protocol support...

Hello,
You can run following command line, and SSL3 will be disable in your Opera 26 :

%PATH-TO-YOUR-OPERA-VERSION%\opera.exe --ssl-version-min=tls1

]]>https://forums.opera.com/post/54157https://forums.opera.com/post/54157Wed, 15 Oct 2014 13:42:48 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 11:57:54 GMT]]>Hi,

Opera 12.16 with clean default profile, is shown as "Not vulnerable" to Poodle attack by the site www.poodletest.com/

http://âpp.com/Hfv5

SSLv3 is enabled by default in Opera 12.16 but after the test done, SSLv3 is automatically disabled.
I don't understand why.

Opera 26 seems "vulnerable" and i don't know how to disable SSL v3 protocol support...

]]>https://forums.opera.com/post/54144https://forums.opera.com/post/54144Wed, 15 Oct 2014 11:57:54 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 09:22:00 GMT]]>

According to Opera's Help page you can select the security protocol.
There are extended instructions in the information on certificates.
This would be nice if the features discussed in the Help text exist. However no information is given on finding the settings described and they don't appear to be accessible from the menus.

I can't seem to find such help page on the new Opera 24.

You could select which security protocols you have enabled on the old (12.x) Opera, from the advanced security settings.

]]>https://forums.opera.com/post/54139https://forums.opera.com/post/54139Wed, 15 Oct 2014 09:22:00 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 09:08:56 GMT]]>According to Opera's Help page you can select the security protocol.

There are extended instructions in the information on certificates.

This would be nice if the features discussed in the Help text exist. However no information is given on finding the settings described and they don't appear to be accessible from the menus.

]]>https://forums.opera.com/post/54135https://forums.opera.com/post/54135Wed, 15 Oct 2014 09:08:56 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 08:47:22 GMT]]>Is there any setting where we can disable it for the time being?

]]>https://forums.opera.com/post/54134https://forums.opera.com/post/54134Wed, 15 Oct 2014 08:47:22 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 05:53:59 GMT]]>

Should Opera disable SSL 3?

It seems that this would probably be the wise move.

]]>https://forums.opera.com/post/54123https://forums.opera.com/post/54123Wed, 15 Oct 2014 05:53:59 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 01:17:03 GMT]]>Twitter disabled SSL3 support

]]>https://forums.opera.com/post/54108https://forums.opera.com/post/54108Wed, 15 Oct 2014 01:17:03 GMT<![CDATA[Reply to Any thoughts about the poodle SSL 3 bug? on Wed, 15 Oct 2014 01:05:45 GMT]]>Microsoft Security Advisory 3009008

https://technet.microsoft.com/en-us/library/security/3009008.aspx

]]>https://forums.opera.com/post/54106https://forums.opera.com/post/54106Wed, 15 Oct 2014 01:05:45 GMT