Get your freak on

Hello again

So … as a part of my job I was reading this article about a newly discovered ssl vulnerability , this time on the client side,http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html and I thought, “surely some distros must have disabled this EXPORT ciphers” and right I was ,

Centos/RHEL 6

#   SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

So at least on this point the attach is mitigated as browsers are not allowed to use these ciphers .

Looks good !!! 😀