Featured Articles

Intel refreshes CPU roadmap

Intel refreshes CPU roadmap

Intel has revealed an update to its CPU roadmap and some things have changed in 2015 and beyond. Let’s start with the…

More...
Hands on: Nvidia Shield Tablet with Android 5.0

Hands on: Nvidia Shield Tablet with Android 5.0

We broke the news of Nvidia's ambitious gaming tablet plans back in May and now the Shield tablet got a bit…

More...
Nokia N1 Android tablet ships in Q1 2015

Nokia N1 Android tablet ships in Q1 2015

Nokia has announced its first Android tablet and when we say Nokia, we don’t mean Microsoft. The Nokia N1 was designed…

More...
Marvell launches octa-core 64-bit PXA1936

Marvell launches octa-core 64-bit PXA1936

Marvell is better known for its storage controllers, but the company doesn’t want to give up on the smartphone and…

More...
Nvidia GTX 970 SLI tested

Nvidia GTX 970 SLI tested

Nvidia recently released two new graphics cards based on its latest Maxwell GPU architecture, with exceptional performance-per-watt. The Geforce GTX 970…

More...
Frontpage Slideshow | Copyright © 2006-2010 orks, a business unit of Nuevvo Webware Ltd.
Tuesday, 15 October 2013 11:37

Java broke Android

Written by Nick Farrell



Not the NSA's fault

Georg Lukas (no not him another one) has penned a detailed post claiming that Google is using what he calls ‘horribly broken’ RC4 and MD5 as the default cipher on all SSL connections of Android devices.

He said that both both are extremely insecure as they are both broken and can be easily compromised, but what is odd is that Android used to use a pretty strong DHE-RSA-AES256-SHA ciphers till Android version 2.2.1. During the release of Android 2.3.4 when RC4 and MD5 were elevated as the default cipher and they are still being used on latest Android versions.

But it seems it was neither NSA spooks nor Google’s intention to weaken Android that was the reason for the dodgy promotion of RC4 and MD5. Lucas found that it was all Oracle’s fault. Google engineers were simply implementing what Java’s Reference Implementation (RI 6) were recommending.

Lucas further said the cipher order on the vast majority of Android devices was defined by Sun in 2002 and taken over into the Android project in 2010 as an attempt to improve compatibility. Question is how soon will it take Google to fix the problem, or will its chums in the NSA say that it can’t.

Nick Farrell

E-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
blog comments powered by Disqus

 

Facebook activity

Latest Commented Articles

Recent Comments