4 ms·
> Everyone who had sslv2 enabled at any point in the past must get a new SSL certificate right away. Right? No, unlike Heartbleed, the key isn't leaked directl
by pfg 11y ago
> Everyone who had sslv2 enabled at any point in the past must get a new SSL certificate right away. Right?
No, unlike Heartbleed, the key isn't leaked directly. Revocation and generating a new key isn't necessary - just patch your stuff and disable SSLv2.
> Windows XP has TLS disabled by default, which in practice means unavailable. So we must cut them off. Therefore Windows XP is dead-dead, starting today. Right?
IIRC XP supports TLS 1.0.
- DenisM 11y agoIt does support TLS, but it's disabled out of the box, and no one who is still running XP is likely to turn it on.
- pfg 11y agoThat seems to be the case only for IE 6, not 7 or 8[1] (which are available on XP). [1]: https://en.wikipedia.org/wiki/Template:TLS/SSL_support_history_of_web_browsers https://en.wikipedia.org/wiki/Template:TLS/SSL_support_histo...
- DenisM 11y agoThanks for rescuing me from my own ignorance! I was reading a different chart that wasn't as clear.
- DenisM 11y agoAh so it's not exfiltratimg the key, it uses sslv2 oracle to break captured TLS traffic. Ok, that makes it a lot less scary. Pretty bad still, but least the keys are not compromised.