News for hackers. Stuff that matters.

A comment on Show HN: SSL Decoder – An open-source alternative for the SSL Labs server test.

Re:Show HN: SSL Decoder – An open-source alternative for the... by yrro on Thursday March 26, 2015 @06:11PM (#9273489)
I've tweaked my Apache configuration but don't seem to be able to trigger a rescan--the cipher list doesn't appear to change. I guess it's cached for a little while, but the UI doesn't make that clear.

Also, it's flagging the following ciphers:

  ECDHE-RSA-DES-CBC3-SHA
  EDH-RSA-DES-CBC3-SHA
  DES-CBC3-SHA
These are triple-DES though, rather than just single DES. Is that considered weak these days?
[ Parent | on HN ]
Re:Show HN: SSL Decoder – An open-source alternative for the... by nuxi7 on Friday March 27, 2015 @01:46AM (#9274918)
They have 112-bits of security and are considered fine until 2030 by NIST. (insert opinion of NIST here)

The real reason to disable them is because of how slow they are. The only thing that is gonna actually use 3DES for TLS is MSIE on XP, its the last remaining secure cipher.

[ Parent | on HN ]