Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't understand why AE ciphersuites can't just own the 'A' grade, and everything else be a 'B' and below. You are currently awarding an 'A' "for effort". You should stop, now. We're all adults here.

And yes: you should be encouraging Salsa/Poly1305. They're de facto standards, and will very soon be de jure standards as well. Plenty of other "nonstandard" behavior is encoded into TLS. It's also not fair to call Salsa/Poly1305 a "Google" initiative.



There are still many clients out there that do not support AE ciphersuites (e.g. literally every version of Safari). If SSL Labs capped the grade at B for supporting these clients, then the top grade at SSL Labs would effectively become a B, as no serious site would get an A grade anymore. It wouldn't actually accelerate the transition away from these clients/ciphers.

Making the effective top grade a B might also reduce the physiological motivation for improving a seriously bad TLS config. At least in the US, anything less than an A is considered very close to failing these days (it's silly, but it's the reality). Making changes just to get a B isn't nearly as motivational as making changes to get an A.


Those older clients are actually vulnerable to real cryptographic flaws in TLS.


Which flaw, specifically, would the latest version of Safari be vulnerable to?


I guess it depends on your confidence in the Lucky 13 patch, right?


Indeed.

And to be clear, I'm not saying we shouldn't be moving away from the CBC ciphers as fast as possible - just that dishing out a B grade for supporting a large number of users is not a good way of accomplishing that.


You and tptacek are both right, so how about the following to combine your positions:

* Grade 'A' requires AES-GCM and ChaCha20Poly1305 * Allow CBC for 'A' iff it's a last resort option * Use nginx equivalent of "ssl_prefer_server_ciphers on;"

CBC would then only be used by clients that don't support AE ciphersuites.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: