SSL broken, again, in POODLE attack

Yet another flaw could prove to be the final nail in SSLv3's coffin.

Read the whole story

 

[Yuhong bao]

gpriatko[/url]":imf39o4m]> Every https site I've checked so far is using TLS

Which TLS?

SSLv3 and TLS1.0 are equally at risk.

Not to this attack.

 

[Yuhong bao]

If you absolutely have to use IE6, go to Internet Options's Advanced tab and check TLS 1.0 and while you are at it uncheck SSL 2.0. But of course the preferred solution is to upgrade and while you are it please also update to XP SP3 if you hasn't already. There is no WGA check in WinXP service pack in general, despite such misconceptions.

 

[Yuhong bao]

dooferorg[/url]":3iro6xdj]As well as SSL3 needing to go there's the phasing out of SHA1 too.

Certificates will likely need to be re-signed and webservers reconfigured soon.

Yea, this is one reason why I have been mentioning the need to update to XP SP3 too.