The Web is World-Wide, or who still needs RC4?
May 19, 2014John Graham-Cumming
Summary
This post details Cloudflare's ongoing efforts to deprecate the RC4 encryption protocol due to its known vulnerabilities. It analyzes the remaining usage of RC4, identifying specific user agents, devices (older phones, browsers like IE 5.01, iCab), and geographic regions where it's still prevalent. The post also highlights the unexpected use of RC4 in transparent SSL proxies within large institutions, explaining the technical reasons behind its continued necessity for certain legacy systems and the challenges in fully deprecating it.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack