3 ms·

Maybe I'm misunderstanding, but wouldn't the real issue be whether the Windows 8 client will use SSLv2, not whether the server does? I'm imagining a third party

by graue 14y ago

Maybe I'm misunderstanding, but wouldn't the real issue be whether the Windows 8 client will use SSLv2, not whether the server does? I'm imagining a third party doing a MITM attack, posing as Microsoft's SmartScreen server and saying it only does SSLv2.

cyberl0l 14y ago
You're absolutely right. If only the server supports SSLv2 then there's not much an attacker can do.
sriramk 14y ago
Typically the client checks to see whether the server has the right certificate. That protects against this.