News for hackers. Stuff that matters.

A comment on Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010. Parent comment

Re:Why Android SSL was downgraded from AES256-SHA to RC4-MD5... by xnyhps on Monday October 14, 2013 @02:12PM (#6548702)
Do you want to make the gamble that every server has "honor cipher order" on and configured in a saner way?
[ Parent | on HN ]
Re:Why Android SSL was downgraded from AES256-SHA to RC4-MD5... by effhaa on Monday October 14, 2013 @02:18PM (#6548737)
Yes, you might have a point, depending on the application - but I guess most apps do have their own set of "backend servers", so modifying the servers or the client should be pretty much the same effort. Modifying the server doesnt need a client side update, though.
[ Parent | on HN ]