4 ms·
You can tell a lot about the legitimacy of a company in the "security space" by their SSL/TLS config on key sites. As of this reply they've still not patched /
by patcheudor 12y ago
You can tell a lot about the legitimacy of a company in the "security space" by their SSL/TLS config on key sites. As of this reply they've still not patched / disabled SSLv3 to guard against POODLE.
https://www.ssllabs.com/ssltest/analyze.html?d=store.mackeeper.com https://www.ssllabs.com/ssltest/analyze.html?d=store.mackeep...
- amenghra 12y agoYou should not blindly believe ssllabs.com without spending time further digging into the results. For example, some sites have decided to keep sslv3 but only support ciphers which are not prone to Poodle. I'm not saying it's the case here, but be cautious about blindly believing everything ssllabs.com reports.
- patcheudor 12y agoWhere sites have chosen to keep SSLv3 and mitigate via cipher selection SSLLabs makes note of it without impacting the overall score: "This server uses SSL 3, with POODLE mitigated. Still, it's recommended that this protocol is disabled."
- deleted 12y ago[deleted]
- amenghra 12y agoI was going to say it's not always the case, but you are right! Thanks for pointing that out.