Re: [RFC] Improved TLS Defaults
Hi Daniel,
For those not overly familiar with attacks, here's a couple of references
for consideration:
http://news.netcraft.com/archives/2013/06/25/ssl-intercepted-today-decrypted-tomorrow.html
http://www.isg.rhul.ac.uk/tls/Lucky13.html
(related to previous padded
oracle attack)
The Mozilla defaults are geared towards achieving perfect forward security
where possible (looks like IE and Safari have a way to go!) and it's
becoming more prominent with the NSA's activities.
The RFC, at a minimum, seems a positive change.
Paddy
--
Pádraic Brady
http://blog.astrumfutura.com
http://phpsecurity.readthedocs.org <http://www.survivethedeepend.com/>
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative
Thread (7 messages)