3 ms·
No. A few months ago, in our security Slack channel we reported of vulnerabilities in a few of our micro services regarding vulnerable cyphers being used… secur
by tkiolp4 4y ago
No. A few months ago, in our security Slack channel we reported of vulnerabilities in a few of our micro services regarding vulnerable cyphers being used… security team didn’t do anything. I doubt they’ll do something about OpenSSL in our systems. We operate in around 10 countries, millions of customers. Valued in a few billion dollars.
- technion 4y agoDepending on context, "vulnerable ciphers" often lead to high priority vulnerability alerts that aren't a significant threat in practice. For example, best security practice would have disabled tls 1.0 years ago but most major services only did this in the past year as they dropped internet Explorer support. That's a long way from an actual breach and further still from a potential potential rce.
- thraxil 4y agoYeah, our last pentest report had a bunch of "vulnerable ciphers" listed. I responded by showing that Google, Amazon, and the pentesting company's own sites all used the same ciphers that they flagged.