So I found myself trying to beef up my browser's crypto security and started by making explicit cipher choices. TLS 1.2 only, Perfect Forward Secrecy, no RC4, no SHA/SHA1, and a few other things. In essence: the strongest ciphers only, even with some performance/compatibility penalty.
After a little OS tweaking (gpedit.msc in Win7) for IE and within Firefox and Chrome, I ended up with a much better config than the default ones. Dear god, RC4 is still in wide use...
To my surprise, Google Chrome (and every other Chromium based web browser for that matter) is nowadays by far the most insecure of the three. WTF?! My outdated and forgotten IE6 is much more reassuring at this point. Disclaimer: I only use Firefox, of course.
I know, "you just can't disable TLS 1.0, 1.1, SSL v2 and 3, but come on! I don't care if I can't negotiate a secure session with a web site/server that uses insecure/outdated certs.
Anyways, this is the final status of all three browser's allowed ciphers, in order of preference. To my surprise, Chrome makes it really difficult to disable RC4.
Middle click on these to see my results: (please post yours if you can spare a few secs)
TLS Ciphers - FireFox
TLS Ciphers - IE6 :P
TLS Ciphers - Chromium
If anyone can chime in and teach me how to properly configure it, it'll be really appreciated. Thanks in advance.
On the other hand, if you have not checked your browser's config, I strongly suggest you do that @ this website
Of course, you must visit that URL with every browser (and device) you have that connects to the interwebs.
Note: User agents may display wrong/undefined U-ID. Agent spoofers alive and well...