News for hackers. Stuff that matters.

A comment on On the Security of RC4 in TLS and WPA – Full Paper Released. Parent comment

Re:On the Security of RC4 in TLS and WPA – Full Paper Released by tptacek on Monday July 08, 2013 @05:27PM (#6009437)
Because here "client-side bot" includes bots written in Javascript served up from arbitrary pages on the web.

I don't understand your second question, like, at all.

[ Parent | on HN ]
Re:On the Security of RC4 in TLS and WPA – Full Paper Released by mikegioia on Monday July 08, 2013 @05:58PM (#6009624)
I'm asking why configure your web server to use RC4 at all if there are better algorithms to use. I'm under the assumption that people use RC4 because it's either less taxing on the web server, or more browsers support it.
[ Parent | on HN ]
Re:On the Security of RC4 in TLS and WPA – Full Paper Released by tptacek on Monday July 08, 2013 @06:01PM (#6009642)
Oh, sorry. A few years ago, people might have selected RC4 for its speed. These days, people who deliberately enable RC4 are doing it because they're concerned about the Lucky13 attack on TLS CBC. It's a rock/hard-place situation with a pair of TLS vulnerabilities that both require adoption of TLS 1.2 to decisively mitigate.
[ Parent | on HN ]