Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
@ConorMancone i'm being optimistic and try to rule out malicious intent, instead focusing on a way to prove ownership. However, i guess security measures mechanisms pretty much imply the possibility of malicious intent, so it doesn't make much sense to rule it out of the discussion indeed.
From the client-side perspective, you can cook up almost anything locally and try to send it to the server. But if the server is serious about security, it should have rigorous validations over everything it receives. It can't control everything it receives from you, but at least it can detect if it's a manipulated packet that doesn't fit the normal pattern.
@Ajedi32 I wrote to their support email account. Even if they have no idea what it means, they should know to forward it to the most appropriate inbox. Anyway, I still haven't received any reply yet, which is disappointing.
I wrote them (the payment processor company) an email inquiring about this and now i'm waiting for a response. I'm really curious what they will reply.
Steffen Ullrich drives the point home here: ok, go ahead and allow older ciphers for ignorant or insufficiently secured clients, but at least allow the more security-aware clients to make use of stronger ciphers. What harm could they do anyway?
