4 ms·
$ curl -vI https://crypto.cat * About to connect() to crypto.cat port 443 (#0) * Trying 94.254.0.157... * connected * Connected to crypto.cat
by graue 13y ago
$ curl -vI https://crypto.cat
* About to connect() to crypto.cat port 443 (#0)
* Trying 94.254.0.157...
* connected
* Connected to crypto.cat (94.254.0.157) port 443 (#0)
* successfully set certificate verify locations:
[ ... snip ... ]
* SSLv3, TLS handshake, Finished (20):
* SSL connection using ECDHE-RSA-RC4-SHA
If my understanding is correct, ECDHE offers "perfect forward secrecy", as discussed on HN a few days ago — each session uses an ephemeral key created for just that session. So past sessions are already protected against an SSL private key compromise, and changing the key wouldn't add protection.
Of course, only the Cryptocat folks could clarify what percentage (all?) of their users actually connect over an SSL method that offers PFS.
- Nursie 13y agoAssuming the server is set up to prefer these suites, and the browser supports them, this is good. Pretty sure all modern browsers will support this, though they may prefer other suites and the server may go with client preferences. 'course RC4 is considered more than a bit iffy itself these days.
- Spittie 13y agoAs this blog post says, ECDHE got implemented only "in the past couple of weeks", which mean that there are still about six months of conversations that didn't use ECDHE and can be easily cracked in case someone leaks their SSL keys.