{"action":"created","issue":{"url":"https://api.github.com/repos/lgarron/badssl.com/issues/1","labels_url":"https://api.github.com/repos/lgarron/badssl.com/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/lgarron/badssl.com/issues/1/comments","events_url":"https://api.github.com/repos/lgarron/badssl.com/issues/1/events","html_url":"https://github.com/lgarron/badssl.com/issues/1","id":67248888,"number":1,"title":"Additional bad configurations","user":{"login":"lgarron","id":248078,"avatar_url":"https://avatars.githubusercontent.com/u/248078?v=3","gravatar_id":"","url":"https://api.github.com/users/lgarron","html_url":"https://github.com/lgarron","followers_url":"https://api.github.com/users/lgarron/followers","following_url":"https://api.github.com/users/lgarron/following{/other_user}","gists_url":"https://api.github.com/users/lgarron/gists{/gist_id}","starred_url":"https://api.github.com/users/lgarron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lgarron/subscriptions","organizations_url":"https://api.github.com/users/lgarron/orgs","repos_url":"https://api.github.com/users/lgarron/repos","events_url":"https://api.github.com/users/lgarron/events{/privacy}","received_events_url":"https://api.github.com/users/lgarron/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-04-09T00:13:52Z","updated_at":"2015-10-20T22:14:15Z","closed_at":"2015-05-15T18:49:52Z","body":"## Certificate Issues\r\n\r\n- [ ] SHA-1 expiring in 2017 (#16)\r\n- [ ] OCSP / CT? (#17)\r\n  - Maybe must-staple without stapling?\r\n- [ ] `weak-rsa.badssl.com` (idea from @noncombatant) (#18)\r\n- [x] `missing-intermediary.badssl.com` or `incomplete-chain.badssl.com` (idea from @noncombatant)\r\n- [x] `hostname-mismatch.badssl.com` or `wrong.host.badssl.com` (idea from @saschaf)\r\n  - Perhaps make `wrong-host.badssl.com` work instead, to avoid confusion about which ones are hyphenated?\r\n\r\n## Cipher Suites / Protocol\r\n\r\n- [x] CBC\r\n- [ ] SSLv3 (#20)\r\n- [ ] TLSv1 (#21)\r\n- [ ] Other SSL/TLS versions?\r\n- [ ] Mozilla's [modern/intermediate/old configs](https://mozilla.github.io/server-side-tls/ssl-config-generator/). [#22]\r\n  - [ ] Modern one at [`not.badssl.com`](https://not.badssl.com)? :-P\r\n- [ ] `no-pfs.badssl.com` (idea from @noncombatant) (#23)\r\n- [ ] `export.badssl.com` (export-grade ciphersuites; idea from @noncombatant) (#24)\r\n- [x] Weak EDH key (see [`demo.cmrg.net`](https://demo.cmrg.net/)). (44df428186b432583cee701df388184726f54a4b and aea4d8e05fadd8edc42db127e9cae1ffdaec9924)\r\n\r\n## Headers\r\n- [x] HSTS\r\n  - [x] preloaded-hsts.badssl.com\r\n- [ ] HPKP (#15)\r\n\r\n## Content\r\n\r\n- [x] Mixed Content\r\n- [ ] Mixed Scripts (#33)\r\n- `mixed-____.badssl.com`? (image, audio, video, XHR, Flash, [etc.](https://www.bennish.net/mixed-content.html))\r\n- [ ] Migrate `mixed-content-test.appspot.com`? (#32)\r\n\r\n## Misc\r\n\r\n- [ ] oe.badssl.com (opportunistic encryption; idea from @noncombatant) (#25)\r\n- [x] http.badssl.com (redirect to HTTP)"},"comment":{"url":"https://api.github.com/repos/lgarron/badssl.com/issues/comments/149718000","html_url":"https://github.com/lgarron/badssl.com/issues/1#issuecomment-149718000","issue_url":"https://api.github.com/repos/lgarron/badssl.com/issues/1","id":149718000,"user":{"login":"lgarron","id":248078,"avatar_url":"https://avatars.githubusercontent.com/u/248078?v=3","gravatar_id":"","url":"https://api.github.com/users/lgarron","html_url":"https://github.com/lgarron","followers_url":"https://api.github.com/users/lgarron/followers","following_url":"https://api.github.com/users/lgarron/following{/other_user}","gists_url":"https://api.github.com/users/lgarron/gists{/gist_id}","starred_url":"https://api.github.com/users/lgarron/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lgarron/subscriptions","organizations_url":"https://api.github.com/users/lgarron/orgs","repos_url":"https://api.github.com/users/lgarron/repos","events_url":"https://api.github.com/users/lgarron/events{/privacy}","received_events_url":"https://api.github.com/users/lgarron/received_events","type":"User","site_admin":false},"created_at":"2015-10-20T22:14:15Z","updated_at":"2015-10-20T22:14:15Z","body":"> No. No browser hides the favicon.\r\n\r\nWhile SSL stripping and favicon manipulation are definitely worrisome tricks, I hope you'll concede that Safari *does* hide the favicon while you're not editing the URL bar, as in the screenshot above. ;-)"}}