0

It is my understanding that BEAST only works on TLS1.0 and I got confused when I saw a demonstration of BEAST attack on paypal.com, locally: https://www.youtube.com/watch?v=BTqAIDVUvrU

Paypal uses TLS1.2, so I'm not sure how the attack could reveal the message, or cookie in this case?

4

Paypal supports TLS 1.0, 1.1, and 1.2. If your browser advertises that it would like to use TLS 1.2, then that is indeed the TLS version that Paypal will choose to connect with. If, however, your browser suggests to Paypal's servers that the highest TLS version it supports is 1.0, then Paypal will happily connect using that protocol version as well. I imagine that this is exactly what whoever was demoing BEAST did. Set their browser up so that it would only use v1.0, and not 1.1 or 1.2.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.