Gmail Disabling RC4 and SSLv3 SMTP Support

#1

Post by berbc » Thu, May 19, 2016, 2:25 PM UTC

Gmail Disabling RC4 and SSLv3 SMTP Support
cryptosense.com

Re: Gmail Disabling RC4 and SSLv3 SMTP Support

#2

Post by yuhong » Thu, May 19, 2016, 7:23 PM UTC

If you are on Windows Server 2003, install https://technet.microsoft.com/en-us/library/security/ms10-02... with /b:SP2QFE, otherwise your mail server may stop working. (Yes, installing https://support.microsoft.com/en-us/kb/957047 should do this for you, but this is safer especially considering how Server 2003 don't use CBS servicing)

Re: Gmail Disabling RC4 and SSLv3 SMTP Support

#3

Post by aexaey » Thu, May 19, 2016, 7:50 PM UTC

yuhong wrote: post #2

If you are on Windows Server 2003, install https://technet.microsoft.com/en-us/library/security/ms10-02... with /b:SP2QFE, otherwise your mail server may stop working. (Yes, installing https://support.microsoft.com/en-us/kb/957047 should do this for you, but this is safer especially considering how Server 2003 don't use CBS servicing)

Thank you for mentioning this. I was really struggling to understand reasons for not dropping SSL3 much, much earlier.

Re: Gmail Disabling RC4 and SSLv3 SMTP Support

#4

Post by gram657 » Thu, May 19, 2016, 8:30 PM UTC

aexaey wrote: post #3

yuhong wrote: post #2

If you are on Windows Server 2003, install https://technet.microsoft.com/en-us/library/security/ms10-02... with /b:SP2QFE, otherwise your mail server may stop working. (Yes, installing https://support.microsoft.com/en-us/kb/957047 should do this for you, but this is safer especially considering how Server 2003 don't use CBS servicing)

Thank you for mentioning this. I was really struggling to understand reasons for not dropping SSL3 much, much earlier.

I guess google's first move was to start identifying mail sent in cleartext with the unlocked red padlock symbol. That was in February 2016. This is stage 2.

Re: Gmail Disabling RC4 and SSLv3 SMTP Support

#5

Post by yuhong » Thu, May 19, 2016, 11:03 PM UTC

aexaey wrote: post #3

yuhong wrote: post #2

If you are on Windows Server 2003, install https://technet.microsoft.com/en-us/library/security/ms10-02... with /b:SP2QFE, otherwise your mail server may stop working. (Yes, installing https://support.microsoft.com/en-us/kb/957047 should do this for you, but this is safer especially considering how Server 2003 don't use CBS servicing)

Thank you for mentioning this. I was really struggling to understand reasons for not dropping SSL3 much, much earlier.

This is not about SSLv3, this is about CBC ciphersuites. But yes I should mention that IBM Domino used to be SSLv3 only.