Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Uhhh.... RC4 + SSL = broken cryptosystem, right?

We're not bummed about additional incentives to avoid this broken approach to TLS, are we? This is actually a fucking good thing.



We're not bummed out because the cryptosystem is broken, but rather that every victory for a faulty patent is a victory for the system around which faulty patents are allowed to thrive (and strangle out others). Regardless of the tech behind the "patent" and whether it's feasible or not, it's another situation where a dubious patent has wrung money out of someone by exploiting our vulnerable system.


RC4 is no longer recommended, but is the best supported method as I understand it [0]. There's also the issue that the most widely available versions of openssl do not support PFS or tls 1.2. You need to download and compile a newer version of openssl (rather than using packages - RHEL in particular since that's what we use), and then compile whatever web server or proxy again with the newer openssl support.

[0] https://community.qualys.com/blogs/securitylabs/2013/03/19/r...


Isn't SSL in this context a shorthand for SSL or TLS? A quick visit to Newegg's site shows them using TLS 1.0. Has RC4 been publicly broken?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: