RC4 support in SSL configuration

Question

GitHub recently improved its SSL setup by removing RC4 support:

To keep GitHub as secure as possible for every user, we will remove RC4 support in our SSL configuration on github.com and in the GitHub API on January 5th 2015.

RC4 has a number of cryptographic weaknesses that may be exploited, impacting the security of your data. More details about these vulnerabilities are listed in the current IETF draft.

If you are using Internet Explorer on Windows XP, you will no longer be able to access github.com once this change takes place. Windows XP only supports outdated SSL ciphers, is no longer supported by Microsoft, and contains a known critical security problem in its SSL implementation.

Since this breaks the site in Internet Explorer on Windows XP, I assume that sites that are accessible with IE on Windows XP must support RC4 ciphers.

Does this mean that those sites are not as secure as possible?

Answer 1

There is only one way to make a site as secure as possible: take it completely offline. Everything else is a compromise: what browsers and clients do you want to allow to your site.

Even GitHub is still not as secure as possible. They allow TLS 1.0 and TLS 1.1 while there is a newer TLS 1.2. Disabling TLS 1.0 and TLS 1.1 would however deny users with Internet Explorer 7/8/9 on Vista which they are not (yet) willing to do.

To answer your question: yes, those other sites are not as secure as possible. But neither is GitHub.

Answer 2

You can enable 3DES which is an alternative that existed before AES, but it is one of the slowest TLS cipher suites.