Skip to main content
Server Fault

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

3
  • 1
    RC4 may be safe from that exploit. But last I heard RC4 had many problems of its own. Also, I cannot find anywhere that says that BEAST is "public knowledge". Its existence is, but that is very different than the exploit itself being public knowledge. Granted we will need a solution soon, but it sounds like TLS 1.1 and 1.2 are not vulnerable to the BEAST and seem like a much better solution than using RC4. Disclaimer, I am no expert, just piping in cause I am curious. Commented Sep 24, 2011 at 3:53
  • I didn't down vote. Just so you know. I appreciated your answer. Did you delete it? Here is an interesting post I found about BEAST and Chrome. In the article it points out that Google's servers have preferred RC4 for a long time. I found that encouraging. Commented Sep 24, 2011 at 4:56
  • Yep, RC4 wasn't bad, WEP was (which uses RC4). So much bad is from the flawed designers ideas about what it 'safe' with a particular cipher. Hopefully TLS 1.2 gets it right. Commented Sep 24, 2011 at 18:22