3

I'm trying to access a website over HTTPS. However, it appears that it uses weak encryption: specifically, RC4.
Is there a way to improve the security of my connection to the website? I've been looking into Tor, but unfortunately all exit nodes appear to be blacklisted on the website I'm trying to access.

3

Part of the SSL Handshake is to determine the cipher to use during transmission. The cipher suite order can be set server side. Is RC4 the only algorithm being used?

You can disable the algorithm on the client side by editing the registry.

See this link. MS published an update to disable RC4. I also believe you can use a tool called iis crypto to edit your registry.

For firefox, it seems like you can control the SSL ciphers via the about:config page. Look for security.ssl3

  • Do you know of any way to check if other algorithms are used? Firefox only says "Connection encrypted: High-grade encryption (RC4, 128 bit keys)". Also, it'd be nice if you could find some resources which also work on Linux or Mac as well. – Giulio Muscarello Mar 6 '14 at 22:42
  • Sorry, always assume Windows :( – CtrlDot Mar 6 '14 at 22:46
  • nmap has a plugin to enum the SSL ciphers in use. owasp.org/index.php/Testing_for_Weak_SSL/… – CtrlDot Mar 6 '14 at 22:46
  • Almost forgot, qualys has an SSL testing tool. ssllabs.com/ssltest As for linux, I think openssl is used and there should be a conf. I'm not at a linux box to check tho. Will update if I find anything – CtrlDot Mar 6 '14 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.