3 ms·
Absolutely. But since we still have to support SSLv3 from 1996, I wouldn’t hold my breath. :(
by hynek 14y ago
Absolutely. But since we still have to support SSLv3 from 1996, I wouldn’t hold my breath. :(
- thirsteh 14y agoYeah. The outlook is not that great, and RC4 will definitely be better than CBC for those legacy systems in light of this discovery (http://www.isg.rhul.ac.uk/tls/ http://www.isg.rhul.ac.uk/tls/). At least the browsers are actively working on supporting the latest TLS and modes.
- hynek 14y agoYes, the discovery of Lucky13 and the following helplessness by many not-really-ops-but-doing-it-anyway people were the motivation to write that article in the first place. To get a minimal baseline security out there. Those who know better, will do better. There’s enough additional links to get hooked up. Can’t do more. :)
- tptacek 14y ago"Lucky 13" isn't exactly an ops crisis. You probably don't need to stay up late patching this one, unless you're using DTLS.
- hynek 14y agoOh certainly not a crisis – especially since it didn't bring new vectors to the table. I just saw many “what now!?”s in my timelines and figured I better give them a solid good-enough solution that just works before they do something stupid.
- huxley 14y agoDo we really? What browsers don't support at least TLS 1.0? Or is it other user agents?
- hynek 14y agoIt very much depends on your target audience. We’re in the web hosting business and whenever we try to be a bit more progressive, people start yelling at us that their IE 4-using customers in rural Mongolia can’t SSL-surf their shop. When it comes to mail, IIRC some business phones were behind too. OTOH iOS 6 support TLS 1.2, so if you’re just building a REST API for your own apps, you can go wild.