News for hackers. Stuff that matters.

A comment on POODLE and the fundamental market failure of browser security.

Re:POODLE and the fundamental market failure of browser secu... by ynik on Monday October 20, 2014 @04:47PM (#8484397)
Don't forget that SSL/TLS normally resists downgrade attacks -- but browsers use insecure fallback due to servers that don't properly handle the SSL handshake. The whole purpose of TLS_FALLBACK_SCSV is just to re-enable the TLS downgrade resistence while retaining compatibility to those broken servers.

I wonder what would effect more users - disabling SSLv3, or disabling insecure fallback?

[ Parent | on HN ]

There are no comments on this comment yet.