My bank's website uses HTTPS with the cipher suite
What are the known weaknesses of this suite? Do they have a practical impact for banking-related communications?
|show 1 more comment|
In a purist cryptographic sense, there are many vulnerabilities in this cipher suite that can be (theoretically and practically) exploited. There are much stronger versions of SSL/TLS, and much stronger cipher suites that could be used.
In a practical sense, it's not the end of the world - there are far worse cipher suites (e.g. those using intentionally weaked 'export' encryption, or weak ciphers such as DES), and you probably have more to fear from malware/phishing attacks etc. wrt interacting with your bank than from someone targeting your SSL connection.
Bear in mind that the cipher suite being used is what the bank web server chose to use based on the cipher suites your web browser told it could be used - if your browser is configured to disable TLS 1.0/1.1 for example, this may be the best the server could manage (although from the use of MD5, this appears unlikely).
If you're interested in the detail, then looking at each of the parts of ssl_rsa_with_rc4_128_md5 individually:
Most of these issues are in the walk, don't run, to the exit category (the use of MD5 being probably the most concerning issue) - it would be prudent for your bank (and you) to start using more modern cipher suites to protect traffic.