News for hackers. Stuff that matters.
Re:Disabling SSLv3 and RC4 by stephengillie on Friday September 18, 2015 @01:57AM (#10237691)
Isn't 3DES still "considered secure"? I know DES has been broken, but major Cloud hosts still recommend 3DES in their VPNs.
Re:Disabling SSLv3 and RC4 by delan on Friday September 18, 2015 @02:15AM (#10237730)
It's only secure when used with TLS 1.1+ where it has an effective security of 112 bits. Otherwise it is susceptible to the BEAST attack, like any other CBC cipher suite, unless the client has been updated to mitigate the attack.
Re:Disabling SSLv3 and RC4 by cakes on Friday September 18, 2015 @09:03AM (#10238905)
Actually just had this conversation with someone about setting up a new https setup for hosting a tool and the amount of online "guides" that still reference 3DES (when other options may be more suitable) is impressively high. Yes 3DES is still "secure" in situations but other alternatives are preferred when we can take them.
Re:Disabling SSLv3 and RC4 by wolf550e on Friday September 18, 2015 @04:00AM (#10237994)
It is secure, but it is much slower than AES and requires frequent rekeying because of small block size.