2 ms·
I think this is the same test that once made it impossible to get an A if RC4 is not on top of the ciphersuite list.
by yuhong 13y ago
I think this is the same test that once made it impossible to get an A if RC4 is not on top of the ciphersuite list.
- ivanr 13y agoLike it or not, sometimes it's necessary to choose the less of two evils. There was a time when BEAST was the best known attack against SSL, RC4 was not thought to be as weak as it is today, and RC4 was the only way to mitigate BEAST server-side. Eventually, even Safari/OSX implemented the 1/n-1 split defense against BEAST, at which point we stopped requiring server-side mitigation for it. EDIT: actually, SSL Labs stopped requiring server-side BEAST mitigation a month or so before Apple finally handled BEAST in OSX Mavericks. It happened only after I had been satisfied that BEAST exploitation was not very likely. You can find more information here: http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.html http://blog.ivanristic.com/2013/09/is-beast-still-a-threat.h...