<div dir="ltr"><div>I was wrong, and you are correct, it sets security.tls.version.enable-deprecated.</div><div><br></div><div>As far as security.tls.insecure_fallback_hosts goes, it will only work if you also set security.tls.version.enable-deprecated.</div><div><br></div><div>Mike<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jul 7, 2020 at 11:08 AM Eddie Rowe <<a href="mailto:eddie.rowe@tdhca.state.tx.us">eddie.rowe@tdhca.state.tx.us</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-3991140846592315709WordSection1">
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Years ago I could have sworn we used security.tls.insecure_fallback_hosts to list a specific host that we wanted to allow to use an older version of TLS while we waited on the
site to be upgrade while not having to adjust the security.tls.version.min setting.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:rgb(31,73,125)">My testing with Firefox 78.0.1 (x86) does
<b>not</b> show the security.tls.version.min being changed after clicking on the button to enable TLS 1.0. I backed out the last node of the search and I can see the entry that was added for telemetry. I even closed Firefox and relaunched and other than the
telemetry entry I do not see where the preference was changed.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-family:"Calibri",sans-serif;color:rgb(31,73,125)">Before clicking on Enable TLS 1.0/1.1 button:<u></u><u></u></span></b></p>
<p class="MsoNormal"><img style="width: 8.3166in; height: 1.8in;" id="gmail-m_-3991140846592315709Picture_x0020_1" src="cid:1732ade956b4cff311" width="798" height="173"><span style="font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-family:"Calibri",sans-serif;color:rgb(31,73,125)">After clicking on the Enable TLS 1.0/1.1 button:<u></u><u></u></span></b></p>
<p class="MsoNormal"><img style="width: 8.3416in; height: 3.625in;" id="gmail-m_-3991140846592315709Picture_x0020_2" src="cid:1732ade956c5b16b22" width="801" height="348"><span style="font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11pt;font-family:"Calibri",sans-serif"> Mike Kaply <<a href="mailto:mkaply@mozilla.com" target="_blank">mkaply@mozilla.com</a>>
<br>
<b>Sent:</b> Tuesday, July 7, 2020 9:56 AM<br>
<b>To:</b> Eddie Rowe <<a href="mailto:eddie.rowe@tdhca.state.tx.us" target="_blank">eddie.rowe@tdhca.state.tx.us</a>><br>
<b>Cc:</b> Wes Kocher <<a href="mailto:kwierso@gmail.com" target="_blank">kwierso@gmail.com</a>>; enterprise <<a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a>><br>
<b>Subject:</b> Re: [Mozilla Enterprise] Firefox 78.0.1 Enable TLS 1.0 and 1.1 Button<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">It changes the pref security.tls.version.min and sets a pref so we know it was done.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">It enables it for all sites (there's no good way to do it for a single site).<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">If you don't want this behavior, you can use policy to set the minimum SSL version and the button will not display.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">At some point in the future, TLS 1.0 and 1,1 will go away completely.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Mike<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, Jul 6, 2020 at 4:24 PM Eddie Rowe <<a href="mailto:eddie.rowe@tdhca.state.tx.us" target="_blank">eddie.rowe@tdhca.state.tx.us</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:black">I am trying to figure out HOW it does this. Is this enabling TLS 1.0 and 1.1 for ONE web site or all sites (I have only
found one site with no TLS 1.2 support)? How do we back out what change was made by clicking on the button to enable? I tried to reverse engineer it so I opened about:config and the only change I see relating to TLS is the
</span><span style="color:black">security.tls.version.enable-deprecated that gets set to true after you click on the button. If I revert this value back to false, Firefox still will work with a site that I have discovered to be TLS 1.0 only. I goggled the
term and there is a bugzilla entry that makes it sound like this setting is just for telemetry.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:black"> </span><u></u><u></u></p>
<p class="MsoNormal"><span style="color:black">This should be functionality that is documented somewhere. I would expect lots of people to be interested in this info.</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-family:"Calibri",sans-serif;color:rgb(31,73,125)"> </span><u></u><u></u></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11pt;font-family:"Calibri",sans-serif"> Enterprise <<a href="mailto:enterprise-bounces@mozilla.org" target="_blank">enterprise-bounces@mozilla.org</a>>
<b>On Behalf Of </b>Wes Kocher<br>
<b>Sent:</b> Monday, July 6, 2020 2:14 PM<br>
<b>Cc:</b> enterprise <<a href="mailto:enterprise@mozilla.org" target="_blank">enterprise@mozilla.org</a>><br>
<b>Subject:</b> Re: [Mozilla Enterprise] Firefox 78.0.1 Enable TLS 1.0 and 1.1 Button</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<p class="MsoNormal">That should just re-enable support for the older TLS versions within Firefox. <u></u><u></u></p>
</div>
<p class="MsoNormal"> <u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">On Mon, Jul 6, 2020, 12:02 PM Eddie Rowe <<a href="mailto:eddie.rowe@tdhca.state.tx.us" target="_blank">eddie.rowe@tdhca.state.tx.us</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-style:none none none solid;border-width:medium medium medium 1pt;padding:0in 0in 0in 6pt;margin:5pt 0in 5pt 4.8pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)">
<div>
<div>
<p class="MsoNormal">Does anyone know what clicking on this button will do? Is this creating a registry key on the Windows platform under HKCU or doing something else?<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><u></u><u></u></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Enterprise mailing list<br>
<a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mail.mozilla.org_listinfo_enterprise&d=DwMFaQ&c=2WwxlqHD_9GeHFEUsOHZXg&r=a0pF-r4VjZCyzB4zxbRDcONPyw-KRRoDiBPd4lDRky8&m=Xs78Gs9KkiHVJ99ipaBT7S7UmuwxmuHImeurR5RlpG4&s=gCdB0DZj3URcK9kJlEz5ijn4xNopufhY_ZUUf1vFUBE&e=" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
<br>
To unsubscribe from this list, please visit <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mail.mozilla.org_listinfo_enterprise&d=DwMFaQ&c=2WwxlqHD_9GeHFEUsOHZXg&r=a0pF-r4VjZCyzB4zxbRDcONPyw-KRRoDiBPd4lDRky8&m=Xs78Gs9KkiHVJ99ipaBT7S7UmuwxmuHImeurR5RlpG4&s=gCdB0DZj3URcK9kJlEz5ijn4xNopufhY_ZUUf1vFUBE&e=" target="_blank">
https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <a href="mailto:enterprise-request@mozilla.org" target="_blank">
enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Enterprise mailing list<br>
<a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mail.mozilla.org_listinfo_enterprise&d=DwMFaQ&c=2WwxlqHD_9GeHFEUsOHZXg&r=a0pF-r4VjZCyzB4zxbRDcONPyw-KRRoDiBPd4lDRky8&m=IhkBASYawF-lg0V5Ndl9PEevrx8LRyxR9rxVhHDx7yg&s=1dO0KpTuEJ6zYS4MA03fCZwR4fO3pUUUA3eI-Dniz4c&e=" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
<br>
To unsubscribe from this list, please visit <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__mail.mozilla.org_listinfo_enterprise&d=DwMFaQ&c=2WwxlqHD_9GeHFEUsOHZXg&r=a0pF-r4VjZCyzB4zxbRDcONPyw-KRRoDiBPd4lDRky8&m=IhkBASYawF-lg0V5Ndl9PEevrx8LRyxR9rxVhHDx7yg&s=1dO0KpTuEJ6zYS4MA03fCZwR4fO3pUUUA3eI-Dniz4c&e=" target="_blank">
https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <a href="mailto:enterprise-request@mozilla.org" target="_blank">
enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
</blockquote></div>