3 ms·

Can somebody explain why they are still using RC4 in their configuration? https://community.qualys.com/blogs/securitylabs/2013/03/19/rc4-in-tls-is-broken-now-w

• pfg 12y ago
  The link you provided has the answer: >The difficulty is that, for public web sites that need to support a wide user base, there is practically nothing 100% secure they can use to replace RC4. Also, given the cipher preference, RC4 wont be used with modern browsers.
• huxley 12y ago
  http://blog.cloudflare.com/killing-rc4 http://blog.cloudflare.com/killing-rc4 It's to balance the need to protect against BEAST vs RC4 issues. They use an OpenSSL patch that "disables RC4-based cipher suites for connections using TLS v1.1 and above, while leaving them there to protect users still using TLS v1.0"