5 ms·
Depending on context, "vulnerable ciphers" often lead to high priority vulnerability alerts that aren't a significant threat in practice. For example, best secu
by technion 4y ago
Depending on context, "vulnerable ciphers" often lead to high priority vulnerability alerts that aren't a significant threat in practice. For example, best security practice would have disabled tls 1.0 years ago but most major services only did this in the past year as they dropped internet Explorer support. That's a long way from an actual breach and further still from a potential potential rce.
- thraxil 4y agoYeah, our last pentest report had a bunch of "vulnerable ciphers" listed. I responded by showing that Google, Amazon, and the pentesting company's own sites all used the same ciphers that they flagged.