4 ms·

Why is this bad?

• valarauca1 12y ago
  1) RC4 is broken. 2) TLS 1.1 is nearly 4 years out of date. The fact that the site only uses RC4 shows that the site's manager understands the BEAST attack (as BEAST could attask TLS1.1 that weren't RC4). Yet simply doesn't care about the CRIME attack, or that RC4 is completely cryptographically defunct. If you transfer a static document over RC4 changing keys constantly, you can actually average which bits are high and low, and get the clear text.