Remove 'Changes needed to match the old level' from 'analysis.py'?
sindarina opened this issue · 2 comments
sindarina commented
It seems to me that 'the old level' is well past its due date, with recommendations like;
Changes needed to match the old level:
* consider enabling SSLv3
* use a certificate with sha1WithRSAEncryption signature
* use DHE of 1024bits and ECC of 256bits
* consider enabling OCSP Stapling
Perhaps it should be removed, limiting recommendations to the intermediate and modern levels only?
tomato42 commented
Some people need support for clients like IE 6 on Windows XP pre SP3 or Java 6. For that, settings like that are necessary, even if they are definitely insecure.
After all, it's better to download a current version of Chrome or Firefox over bad encryption than no encryption what so ever.