Android Uses Crap SSL Cipher by Default
October 15th, 2013Via: op-co.de:
Android is using the combination of horribly broken RC4 and MD5 as the first default cipher on all SSL connections.
…
The cipher order on the vast majority of Android devices was defined by Sun in 2002 and taken over into the Android project in 2010 as an attempt to improve compatibility. RC4 is considered problematic since 2001 (remember WEP?), MD5 was broken in 2009.
The change from the strong OpenSSL cipher list to a hardcoded one starting with weak ciphers is either a sign of horrible ignorance, security incompetence or a clever disguise for an NSA-influenced manipulation – you decide!
