News for hackers. Stuff that matters.

A comment on Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010. Parent comment

Re:Why Android SSL was downgraded from AES256-SHA to RC4-MD5... by ge0rg on Monday October 14, 2013 @02:57PM (#6548940)
You are right, the final choice of the algorithm is with the server. I am not sure though if it is possible to give other ciphers a higher priority on the server without completely disabling RC4 (which is still better than no encryption / no connection).

Edit: effhaa mentioned http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslhon... for apache in another post.

[ Parent | on HN ]
Re:Why Android SSL was downgraded from AES256-SHA to RC4-MD5... by mnordhoff_ on Monday October 14, 2013 @03:28PM (#6549100)
Nginx has an equivalent preference, ssl_prefer_server_ciphers on. (Scroll down a bit on evmar's link.)
[ Parent | on HN ]