1

The POODLE vulnerability was discovered by Google in October 2014, and unlike heartbleed, it had a simple solution: just disable SSL v3. Now, most of the websites have disabled SSL v3 but ironically it is Google that still supports it. Any idea as to why Google still supports SSL v3?

I tested the domain name in a POODLE tester website and it shows Google to be still vulnerable to it. Any ideas guys?

1 Answer 1

7

Google promotes and, supposedly, implements TLS Fallback SCSV, by which client and server make sure that if they both support TLS 1.0 or later, they will not use SSL 3.0; with that extension active, an attacker cannot (as far as we know) force a protocol downgrade.

Under these conditions, if SSL 3.0 is used when accessing Google's server, then this will be only if the client really cannot do any better, and, arguably, a poodleable SSL 3.0, though weak, is still much better than no SSL at all.

Of course, one may argue that rejecting clients that know only SSL 3.0 could force these clients to finally upgrade their browsers, and that would make for an altogether better world. But this may also irate the owners of the said out-of-date browsers, and making clients angry is, on a general basis, a poor business practice.

1
  • 1
    not forgetting not all devices in the world support TLS, meaning some are still stuck with only ssl
    – LvB
    May 27, 2015 at 19:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .