2

It is my understanding that IIS has ssl v2 enabled by default. Also, TLS 1.0, if enabled, allows for at least one known major vulnerability titled "beast attack".

If the weak and vulnerable ciphers are disabled from the server is there known cons from application or users perspective?

|improve this question
4

Disabling weaker ciphers on the server can prevent older browsers connecting - which is the main reason this sort of thing is not kept as up to date as security teams would like.

Encouraging organisations to update browsers, and to require their customers to upgrade, is good practice and helps remove outdated versions and ciphers.

|improve this answer
  • 1
    I think any browser that can't use anything better than SSLv2 is probably sufficient ancient to be vulnerable to plenty of other issues. AFAIR IE 5 (or perhaps 5.5) already had support for SSLv3. I'd be tempted to say that any decent browser less than 5 years old should at least be compatible with TLS 1.0. – Bruno Jun 28 '12 at 23:41
  • I feel comfortable directing users with old browsers to update to something compatible with enabled SSL ciphers before redirecting to HTTPS. There are enough modern browsers and/or alternatives for those cases. Is there a list of browsers with shown enabled ciphers that is maintained anywhere? – Sn3akyP3t3 Jul 6 '12 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.