3 ms·
For the record, Google has been working on adding support for more secure ciphers [1] and the fix is being (has been?) pushed as we speak. Users already reporte
by mrb 12y ago
For the record, Google has been working on adding support for more secure ciphers [1] and the fix is being (has been?) pushed as we speak. Users already reported seeing support for AES-GCM (see Jas Per's scan[2]).
[1] https://news.ycombinator.com/item?id=7775052 https://news.ycombinator.com/item?id=7775052
[2] https://www.ssllabs.com/ssltest/analyze.html?d=r4---sn-uxaxovg-5goz.googlevideo.com https://www.ssllabs.com/ssltest/analyze.html?d=r4---sn-uxaxo...
- harshreality 12y agoIt looks like one AES-GCM and one RC4 ciphersuite, but with RC4 preferred? "Support" for AES-GCM doesn't mean much if an RC4 ciphers is enabled and preferred by the server. 1. There are production servers that are still using RC4 only. 2. Consequently, clients can't disable RC4 3. Consequently, servers that prefer RC4 but offer better ciphersuites are insecure because they will negotiate RC4 even with better ciphers available. Client workarounds might be possible (involving multiple handshakes for rc4-only servers) but aren't implemented?