TLS protocol and chipers used on torproject websites
It appears to me that the TLS configurations and ciphers used on several Torproject websites are in desperate need of someone love and attention.
For instance the main website, https://www.torproject.org/ is only accessible using the old TLSv1.0 not the currently recommended TLSv1.2 (nor the upcoming TLSv1.3). Further more it is not only the protocol versions which are in need of some attention, the ciphers used include also need some improvements. For instance RC4 is used in spite of RFC7465, (apparently also MD5 is used).
If someone site admin where to have a look at it but needs some help along the way the Mozilla Foundation have created a recommended list of ciphers and protocols which can be used as a sort of "best common practise" for HTTPS configuration. And Qaulys ssllabs provide a quick and easy tool to test how it would be handled by various browsers and versions (along with some extra tests).
Sources: Qaulys SSLLabs server test: https://www.ssllabs.com/ssltest/analyze.html?d=www.torproject.org
RFC 7465 - Prohibit RC4 Cipher Suites: https://tools.ietf.org/html/rfc7465
Mozilla foundations recommended configurations: https://wiki.mozilla.org/Security/Server_Side_TLS
Trac:
Username: NoNameForMee