Re: [keycloak-dev] Blacklisting/document broken protocols

On 01.03.2016 21:25, Bruno Oliveira wrote: > > Ahoy, today I was reading about this "new" vulnerability on TLS > ( http://blog.cryptographyengineering.com/2016/03/attack-of-week-drown.html ). > And was wondering if we should blacklist or document broken protocols. > Preventing people to deploy Keycloak in non secure environments. > ... > > Should we document? Blacklist? Or leave it as is? I'd say "do nothing". Good system admins already have something in place that would alert them in those cases, ranging from monitoring vulnerabilities databases to scripting the score check via ssllabs.com. The main problem that I see with adding some sort of support like this directly into Keycloak is that you'd need a lot of effort to keep it up to date. If a comprehensive check cannot be done, people would either ignore it, or people will trust it because of the false sense of security it gives. - Juca. _______________________________________________ keycloak-dev mailing list keycloak-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-dev