Hacker News Reader

SSL 2.0 is a disaster

How bad is this? I have internet-facing production web servers running software which (unfortunately) does not support TLS even in the most recent versions.

Are there practical attacks I should be worried about?

View on HN

Yea, I think it took until 2006 before IE and Firefox was able to disable SSLv2. SNI doesn't work with SSLv3 though, and the increasing IP address crunch and the obsolescence of XP/Server 2003 will make it more common.

Yes. SSL 3.0 is okay, but not 2.0.

okey-er.

Reply on news.ycombinator.com