On Wed, 4 Mar 2015 11:38:11 +1300, Peter Reutemann wrote:
"This was an artifact from decades ago and it was thought that most servers and clients had long ago abandoned such weak ciphers."
Because back in the 1990s the US Government prohibited the export of strong encryption. So SSL protocol implementations had to be able to negotiate a weaker level of encryption when communicating with such crippled “export-grade” products. Which then left them open to the possibility that a “man-in-the-middle” attacker could intervene between two nodes, each capable of handling full-strength encryption, and fool each end into thinking the other end could not, and so force the security of the connection down to a level which can be easily cracked. The SSL libraries included safeguards to try to protect against this, but it turns out they were less than perfect. <https://freedom-to-tinker.com/blog/felten/freak-attack-the-chickens-of-90s-crypto-restriction-come-home-to-roost/> All a result of scaremongering about strong encryption back in those days, that terrorists, paedophiles and all the other usual suspects would be able to use it to evade law enforcement. Oh wait, the scaremongering never actually went away...