1. PCI compliance is a requirement for some types of business 2. PCI compliance requires that some connections are encrypted 3. PCI compliance requires that e

1. PCI compliance is a requirement for some types of business 2. PCI compliance requires that some connections are encrypted 3. PCI compliance requires that encrypted connections follow a set of guidelines, including no RC4 cipher 4. Rule #3 is not limited to encrypted connections mandated in rule #2; this allows people in the organization to assume that all encrypted connections are at least minimally 'secure', rather than 'some connections are secure but some are more secure than others'. PCI compliance doesn't care about unencrypted connections, because they mandate that sensitive data travel over encrypted connections, so unencrypted connections aren't relevant to them at all. So basically, PCI says 'no RC4 ciphers in your enterprise' (for stupid reasons) and does not allow for exceptions (for sane reasons). Google is using RC4 only (for what I assume are practical, if stupid, reasons). It's kind of surprising, since Google (or at least, large swaths of Google) must be PCI compliant considering that they do payment processing, etc.