Tuesday, September 17, 2013

Google's SSL/TSL is broken !

According to AlFardan, Bernstein, Paterson, Poettering and Schuldt (a team from Royal Holloway, Eindhoven and UIC) the RC4 ciphersuite used in SSL/TLS is broken. If you choose to use it -- as do a ridiculous number of major sites, including Google -- then it may be possible for a dedicated attacker to recover your authentication cookies. The current attack is just on the edge of feasibility, and could probably be improved for specific applications.
___________________________
99% BAD HARDWARE WEEK: But some Google employees resisted
I am so glad I resisted pressure from Intel engineers to let /dev/random rely only on the RDRAND instruction.   To quote from the article below: All SSL people will be under the sign of BEAST :::::)

Comments: Post a Comment



<< Home

This page is powered by Blogger. Isn't yours?