From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 9084C138A1F for ; Sat, 19 Apr 2014 15:57:16 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 45754E0B43; Sat, 19 Apr 2014 15:52:58 +0000 (UTC) Received: from lyseo.edu.ouka.fi (unknown [82.128.138.2]) by pigeon.gentoo.org (Postfix) with ESMTP id 14BB6E0B36 for ; Sat, 19 Apr 2014 15:52:57 +0000 (UTC) Received: from [10.168.124.122] (85-76-40-94-nat.elisa-mobile.fi [85.76.40.94]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by lyseo.edu.ouka.fi (Postfix) with ESMTPSA id D2206193F980 for ; Sat, 19 Apr 2014 18:52:55 +0300 (EEST) Subject: Re: [gentoo-user] Re: Heartbleed fix - question re: replacing self-signed certs with real ones References: <201404171649.57228.michaelkintzios@gmail.com> <201404182001.31265.michaelkintzios@gmail.com> <53518AB0.3040802@gmail.com> <201404190033.35662.michaelkintzios@gmail.com> <5352965E.4020708@gmail.com> From: Matti Nykyri Content-Type: multipart/alternative; boundary=Apple-Mail-00D24D92-99C0-457A-8F87-1786C7C8C0AF X-Mailer: iPhone Mail (9B206) In-Reply-To: <5352965E.4020708@gmail.com> Message-Id: <0E54F746-D111-4689-8156-786BFC3FA136@iki.fi> Date: Sat, 19 Apr 2014 18:43:50 +0300 To: "gentoo-user@lists.gentoo.org" Content-Transfer-Encoding: 7bit Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org Mime-Version: 1.0 (1.0) X-Archives-Salt: 5b26b27d-b190-4028-9461-e2cfba6304fa X-Archives-Hash: 4497a4a04f30f39c877f6232a773660b --Apple-Mail-00D24D92-99C0-457A-8F87-1786C7C8C0AF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Apr 19, 2014, at 18:29, Dale wrote: > Mick wrote: > > Encryption still works, at > least for some attackers. The fact that burglars can pick locks > doesn't mean that you should leave your door unlocked. FWIW I just > checked my bank's website encryption ... they *still* use RC4!!! > O_O I guess they are keen to make sure all these customers with > WinXP and MSIE 7.0 can still login? For crying out loud! It seems > that RSA's days may be numbered and elliptic curve cryptography > would be the way forward, not because of resource constrained > mobile devices, but also because of recent advances in > crypto-analytics which may make RSA obsolete: > http://www.technologyreview.com/news/517781/math-advances-raise-the-= prospect-of-an-internet-security-crisis/ > =20 >=20 > How does one find out what their bank uses? I'd like to check on what min= e uses. I have Seamonkey and Firefox installed here IF it matters.=20 Well you can use ssllabs.com. I use it for debuging. Here is what Bank of Am= erica uses: https://www.ssllabs.com/ssltest/analyze.html?d=3Dwww.bankofamerica.com&hideR= esults=3Don -Matti= --Apple-Mail-00D24D92-99C0-457A-8F87-1786C7C8C0AF Content-Transfer-Encoding: 7bit Content-Type: text/html; charset=utf-8

On Apr 19, 2014, at 18:29, Dale <rdalek1967@gmail.com> wrote:

Mick wrote:
> Encryption still works, at least for some attackers. The fact that burglars can pick locks doesn't mean that you should leave your door unlocked. FWIW I just checked my bank's website encryption ... they *still* use RC4!!! O_O I guess they are keen to make sure all these customers with WinXP and MSIE 7.0 can still login? For crying out loud! It seems that RSA's days may be numbered and elliptic curve cryptography would be the way forward, not because of resource constrained mobile devices, but also because of recent advances in crypto-analytics which may make RSA obsolete: http://www.technologyreview.com/news/517781/math-advances-raise-the-prospect-of-an-internet-security-crisis/

How does one find out what their bank uses? I'd like to check on what mine uses. I have Seamonkey and Firefox installed here IF it matters.

Well you can use ssllabs.com. I use it for debuging. Here is what Bank of America uses:

https://www.ssllabs.com/ssltest/analyze.html?d=www.bankofamerica.com&hideResults=on

-Matti

--Apple-Mail-00D24D92-99C0-457A-8F87-1786C7C8C0AF--