News for hackers. Stuff that matters.

A comment on OpenSSL Security Advisory. Parent comment

Re:OpenSSL Security Advisory by captn3m0 on Thursday September 22, 2016 @03:06PM (#12559335)
Off-topic, but a quick question on your project:

> Kerberos

>broken, obsolete, badly designed, underspecified, dangerous and/or insane

Which list does Kerberos fit in?

[ Parent | on HN ]
Re:OpenSSL Security Advisory by ctz on Thursday September 22, 2016 @03:35PM (#12559622)
There are no standard kerberos ciphersuites that use anything better than RC4/IDEA/DES/3DES: http://www.iana.org/assignments/tls-parameters/tls-parameter.... So: broken and obsolete.
[ Parent | on HN ]
Re:OpenSSL Security Advisory by emmelaich on Thursday September 22, 2016 @07:51PM (#12561324)
Recent Windows, Linux and Java Kerberos all standardise on AES* and the ones you list are deprecated and for some have to be explicitly enabled.

So .. progress is being made.

[ Parent | on HN ]