3 ms·
True, but at least BEAST is probably not that much of a concern[1], not sure about the state of Lucky 13 in the grand scheme of things. [1] http://security.sta
by gingerlime 14y ago
True, but at least BEAST is probably not that much of a concern[1], not sure about the state of Lucky 13 in the grand scheme of things.
[1] http://security.stackexchange.com/questions/17080/is-there-a-way-to-mitigate-beast-without-disabling-aes-completely/24489#24489 http://security.stackexchange.com/questions/17080/is-there-a...
- tptacek 14y agoAdam Langley is more concerned about mitigating the CBC mode attacks in TLS than he is about the RC4 attack. I'm going to take his word for that.
- poutine 14y agoBEAST causes PCI scan failures from the major scanning vendors. Therefore it's a significant practical issue for any site taking credit cards. Try the https://www.ssllabs.com/ssltest/index.html https://www.ssllabs.com/ssltest/index.html scan and you'll see what it thinks of your SSL setup. With BEAST vulnerability you get non compliance.
- gingerlime 14y agoYes, I know, but it seems a little bit misguided / misleading, particularly since the BEAST in particular was pretty much mitigated in most browsers (see the link I posted + other links I posted below).
- poutine 14y agoAgreed. Not defending pci. Nevertheless some qsa is going to get their panties in a twist if their scanning tool goes red.
- _phred 14y agoSo as a sort-of-amusing counterpoint to this article, I know at least one ASV who insists that the only way to mitigate BEAST is to disable all ciphers but RC4. Still scratching my head on that one. That tool you posted is great, hugely helpful for anyone who has to deal with this stuff.
- tptacek 14y agoThis is a pretty good illustration of why professional appsec people don't like PCI.
- deleted 14y ago[deleted]