Hacker News Reader

BEAST causes PCI scan failures from the major scanning vendors. Therefore it's a significant practical issue for any site taking credit cards.

Try the https://www.ssllabs.com/ssltest/index.html scan and you'll see what it thinks of your SSL setup. With BEAST vulnerability you get non compliance.

View on HN

So as a sort-of-amusing counterpoint to this article, I know at least one ASV who insists that the only way to mitigate BEAST is to disable all ciphers but RC4. Still scratching my head on that one.

That tool you posted is great, hugely helpful for anyone who has to deal with this stuff.

This is a pretty good illustration of why professional appsec people don't like PCI.

Yes, I know, but it seems a little bit misguided / misleading, particularly since the BEAST in particular was pretty much mitigated in most browsers (see the link I posted + other links I posted below).

Agreed. Not defending pci. Nevertheless some qsa is going to get their panties in a twist if their scanning tool goes red.

Reply on news.ycombinator.com