Hacker News Reader

True, but at least BEAST is probably not that much of a concern[1], not sure about the state of Lucky 13 in the grand scheme of things.

[1] http://security.stackexchange.com/questions/17080/is-there-a...

View on HN

Adam Langley is more concerned about mitigating the CBC mode attacks in TLS than he is about the RC4 attack. I'm going to take his word for that.

BEAST causes PCI scan failures from the major scanning vendors. Therefore it's a significant practical issue for any site taking credit cards.

Try the https://www.ssllabs.com/ssltest/index.html scan and you'll see what it thinks of your SSL setup. With BEAST vulnerability you get non compliance.

So as a sort-of-amusing counterpoint to this article, I know at least one ASV who insists that the only way to mitigate BEAST is to disable all ciphers but RC4. Still scratching my head on that one.

That tool you posted is great, hugely helpful for anyone who has to deal with this stuff.

This is a pretty good illustration of why professional appsec people don't like PCI.

Yes, I know, but it seems a little bit misguided / misleading, particularly since the BEAST in particular was pretty much mitigated in most browsers (see the link I posted + other links I posted below).

Agreed. Not defending pci. Nevertheless some qsa is going to get their panties in a twist if their scanning tool goes red.

Reply on news.ycombinator.com