Hacker News new | past | comments | ask | show | jobs | submit login

But it did help there, as I already pointed out and you ignored twice.



It did not help here. In fact, it amplified the problem. We knew RC4 to be broken when BEAST was announced. Nevertheless, people enabled it, as a "stopgap", to deal with BEAST. RC4 is arguably less secure than BEAST-affected TLS (BEAST was in practice quite difficult to trigger), and, either way, all those RC4 deployments ended up also needing to be scoured off the Internet!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: