Featured Articles

Apple iPad Air 2 costs $275 to build

Apple iPad Air 2 costs $275 to build

IHS has told Recode that the Apple iPad Air 2 16GB Wifi costs only $275 to build -- not bad…

More...
LG sells 16.8 million smartphones in Q3 14

LG sells 16.8 million smartphones in Q3 14

As Samsung is losing market share, another Korean company, which many had written off, is gaining.

More...
LG G Watch R EU price set at €299

LG G Watch R EU price set at €299

LG G Watch R is probably the best looking Android Wear device on the market and many have been waiting for…

More...
Nvidia GTX 970 SLI tested

Nvidia GTX 970 SLI tested

Nvidia recently released two new graphics cards based on its latest Maxwell GPU architecture, with exceptional performance-per-watt. The Geforce GTX 970…

More...
Gainward GTX 970 Phantom previewed

Gainward GTX 970 Phantom previewed

Nvidia has released two new graphics cards based on its latest Maxwell GPU architecture. The Geforce GTX 970 and Geforce GTX…

More...
Frontpage Slideshow | Copyright © 2006-2010 orks, a business unit of Nuevvo Webware Ltd.
Tuesday, 15 October 2013 11:37

Java broke Android

Written by Nick Farrell



Not the NSA's fault

Georg Lukas (no not him another one) has penned a detailed post claiming that Google is using what he calls ‘horribly broken’ RC4 and MD5 as the default cipher on all SSL connections of Android devices.

He said that both both are extremely insecure as they are both broken and can be easily compromised, but what is odd is that Android used to use a pretty strong DHE-RSA-AES256-SHA ciphers till Android version 2.2.1. During the release of Android 2.3.4 when RC4 and MD5 were elevated as the default cipher and they are still being used on latest Android versions.

But it seems it was neither NSA spooks nor Google’s intention to weaken Android that was the reason for the dodgy promotion of RC4 and MD5. Lucas found that it was all Oracle’s fault. Google engineers were simply implementing what Java’s Reference Implementation (RI 6) were recommending.

Lucas further said the cipher order on the vast majority of Android devices was defined by Sun in 2002 and taken over into the Android project in 2010 as an attempt to improve compatibility. Question is how soon will it take Google to fix the problem, or will its chums in the NSA say that it can’t.

Nick Farrell

E-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
blog comments powered by Disqus

 

Facebook activity

Latest Commented Articles

Recent Comments