Ok, this post lacks an important bit of information, and gets something wrong: The reason we disabled SSLv2 at scale is not that it is in itself insecure, or th

Ok, this post lacks an important bit of information, and gets something wrong: The reason we disabled SSLv2 at scale is not that it is in itself insecure, or that it is old or anything. The reason we disabled SSLv2 is the DROWN attack. It is a cross-protocol attack (or let's say cross-protocol-version attack) and the important fact to understand here is: The mere fact that you have SSLv2 enabled puts you at risk. It allows an attacker to essentially use your private key. So, yes, SSLv2 on its own absolutely is a risk if your server supports it. It is completely independent of whether your browser supports it. See: https://drownattack.com/ https://drownattack.com/