3 ms·
They also use a pretty strong TLS conf https://gist.github.com/jvehent/98fdfef139b6237f7bf5 https://gist.github.com/jvehent/98fdfef139b6237f7bf5 What strikes m
by jvehent 12y ago
They also use a pretty strong TLS conf https://gist.github.com/jvehent/98fdfef139b6237f7bf5 https://gist.github.com/jvehent/98fdfef139b6237f7bf5
What strikes me is that their conf is inaccessible to old client (no sslv3, no sha-1 cert). Honest question: does the government think it's ok to break website access from ancient clients (XPSP2 IE6)? Or will they be forced to enable legacy ciphers when the first citizens complain?
I'm genuinely interested, because the topic of TLS modernity is a hard problem to solve. If that was easy, google.com wouldn't be using RC4-MD5 and a sha-1 cert...
- 001spartan 12y agoWith the number of attacks against SSLv3 and/or RC4, I think it's a good idea. Especially given that it's a government website. With a target that large, it's a safe bet that, at any given moment, someone is trying something against that site. And really, who's going to access cio.gov from an XP box? Heh.
- konklone 12y agoJust speaking for myself here, but what makes sense in terms of legacy client support for e.g. taxes or health care may be different than what you need for a set of technical resources.