3

I'm trying to access a website over HTTPS. However, it appears that it uses weak encryption: specifically, RC4.
Is there a way to improve the security of my connection to the website? I've been looking into Tor, but unfortunately all exit nodes appear to be blacklisted on the website I'm trying to access.

Improve this question

1 Answer 1

Reset to default
3

Part of the SSL Handshake is to determine the cipher to use during transmission. The cipher suite order can be set server side. Is RC4 the only algorithm being used?

You can disable the algorithm on the client side by editing the registry.

See this link. MS published an update to disable RC4. I also believe you can use a tool called iis crypto to edit your registry.

For firefox, it seems like you can control the SSL ciphers via the about:config page. Look for security.ssl3

Improve this answer
4
  • Do you know of any way to check if other algorithms are used? Firefox only says "Connection encrypted: High-grade encryption (RC4, 128 bit keys)". Also, it'd be nice if you could find some resources which also work on Linux or Mac as well.
    – Giulio Muscarello
    Mar 6, 2014 at 22:42
  • Sorry, always assume Windows :(
    – CtrlDot
    Mar 6, 2014 at 22:46
  • nmap has a plugin to enum the SSL ciphers in use. owasp.org/index.php/Testing_for_Weak_SSL/…
    – CtrlDot
    Mar 6, 2014 at 22:46
  • Almost forgot, qualys has an SSL testing tool. ssllabs.com/ssltest As for linux, I think openssl is used and there should be a conf. I'm not at a linux box to check tho. Will update if I find anything
    – CtrlDot
    Mar 6, 2014 at 22:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .