Hacker News new | ask | show | jobs
by makomk 4738 days ago
Not particularly. If you read further down, they've marked themselves down because they intentionally disabled protection against the BEAST attack, in order to collect some kind of stats on vulnerable clients.
1 comments

That's right. Good stats on BEAST are difficult to come by, so we're running a passive handshake analyzer[1] on our site in order to determine what amount of our clients support the 1/n-1 split. The last time I looked, about 15% of the browsers we see are still vulnerable to this problem.

[1] For the curious, have a look at https://github.com/ssllabs/sslhaf The 0.1.x branch is the stable one; master is moving from an Apache module toward a portable library.