protonscr

Upgrade TLS support of in-game browser

steamclosed Feature RequestreviewedSteam client
ValveSoftware/steam-for-linux#3192 · opened 2014-03-07 by panzi · updated 2017-11-17 · 6 comments · github
Ppanzi 2014-03-07 github

TLS support in the in-game browser is currently sub-par. https://www.howsmyssl.com/ currently criticizes these things:

Version

Your client is using TLS 1.0, which is very old, possibly susceptible to the BEAST attack, and doesn't have the best cipher suites available on it. Additions like AES-GCM, and SHA256 to replace MD5-SHA-1 are unavailable to a TLS 1.0 client as well as many more modern cipher suites.

TLS Compression

Your TLS client supports compressing the settings that encrypt your connection. This is really not good. It makes your TLS connections susceptible to the CRIME attack and your encrypted data could be leaked!

Insecure Cipher Suites

Your client supports cipher suites that are known to be insecure:

SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA: This cipher was meant to die with SSL 3.0 and is of unknown safety.
TLS_DHE_DSS_WITH_RC4_128_SHA: This cipher uses keys smaller than 128 bits in its encryption.

HHalf-Shot 2014-03-08 github

Well if most of steam doesn't already, could it use webkit or something like that. There are plenty of ways to throw webkit into a GL context and you pretty much get all of the latest features of a web browser for zero effort.

Ppanzi 2014-03-08 github

I think it does use WebKit, just an old version. And I think it is not zero effort to get all the features. Maybe Steam should switch to Blink (Google and Operas WebKit fork). I don't know how well Apple's WebKit is (or will be) supported under Linux. Also the TLS support depends on the used NSS library (under Linux, under Windows it uses a different TLS library, IIRC). I think Blink is switching to OpenSSL.

HHalf-Shot 2014-03-08 github

While I wasn't making the case for Webkit and really just using that as a good example, it is very well supported under Linux and is already used in Garrysmod with the pretty cool library called Awesonium which I have used before. It is also supported in QT and python. And yes, its very much zero effort to include a web control into a GL context, because I have done it before and its literally just sending input to a library and displaying the images back.

Unless valve wants to roll their own solution in which case no one can gauge at how much effort it will take.

Ppanzi 2014-03-08 github

Steam is using WebKit. I just meant that more and more WebKit users are switching to Blink (Chromium) and I fear that thus WebKit support for Linux will not be as good in the future. Qt already announced the switch to Blink/Chromium.

HHalf-Shot 2014-03-08 github

Well I'm all for Blink (I did a little research and its a fork?). As long as you can get all the platforms supported I see no issue with it. Anything from Valve?

Kkisak-valve maintainer 2017-11-17 github

Closing as steam switched to libcef quite a while ago.

Nothing extracted yet.