3 ms·
I'm not saying I've done it recently, but I have configured services to use legacy TLS protocols in purpose. It's better than fallback to plain text in case of
by obscurette 3y ago
I'm not saying I've done it recently, but I have configured services to use legacy TLS protocols in purpose. It's better than fallback to plain text in case of mail services and FTP for example.
- _ahxg 3y agoIf I understood it correctly, it can actually be worse than fallback to plain text, because if a malicious actor can stability a connection using legacy SSLv2, then this connection can be used to decrypt the session for users running the latest TLS version. While plain text connections would affected only users using the plain text connection. See comment from https://news.ycombinator.com/item?id=38047633 https://news.ycombinator.com/item?id=38047633
- obscurette 3y agoIn theory, yes. In practice it's almost certainly already mitigated in client side.