5 ms·
BEAST causes PCI scan failures from the major scanning vendors. Therefore it's a significant practical issue for any site taking credit cards. Try the https:/
by poutine 14y ago
BEAST causes PCI scan failures from the major scanning vendors. Therefore it's a significant practical issue for any site taking credit cards.
Try the https://www.ssllabs.com/ssltest/index.html https://www.ssllabs.com/ssltest/index.html scan and you'll see what it thinks of your SSL setup. With BEAST vulnerability you get non compliance.
- gingerlime 14y agoYes, I know, but it seems a little bit misguided / misleading, particularly since the BEAST in particular was pretty much mitigated in most browsers (see the link I posted + other links I posted below).
- poutine 14y agoAgreed. Not defending pci. Nevertheless some qsa is going to get their panties in a twist if their scanning tool goes red.
- _phred 14y agoSo as a sort-of-amusing counterpoint to this article, I know at least one ASV who insists that the only way to mitigate BEAST is to disable all ciphers but RC4. Still scratching my head on that one. That tool you posted is great, hugely helpful for anyone who has to deal with this stuff.
- tptacek 14y agoThis is a pretty good illustration of why professional appsec people don't like PCI.
- deleted 14y ago[deleted]