Java Spec Compatibility Weakened Android's TLS Encryption 82
sfcrazy writes "It has been discovered that Google downgraded the SSL encryption of Android after version 2.3.4 and defaulted to RC4 and MD5 ciphers. It may appear that NSA is at play here as both are broken and can be easily compromised. But after digging the code Georg Lukas concluded that the blame goes to Oracle. 'The cipher order on the vast majority of Android devices was defined by Sun in 2002 and taken over into the Android project in 2010 as an attempt to improve compatibility.'"
The Java spec from 2002 specified RC4 and MD5 as the first two ciphers for TLS; Android, however, used DHE-RSA-AES256-SHA by default. The default cipher list for Java 7 was updated, but Android is stuck using JDK 6 and a default cipher list over a decade old.
Re:Good old Oracle/Java (Score:3, Interesting)
I don't see what this has to do with Oracle/Java politics.
Google had/has absolutely no idea what the "correct" list of cipher order was/is. Google copied the order from OpenSSL. Google removed dependency on OpenSSL. Google copied from another source, which happened to be Java.
The ultimate choice may have been done for compatibility with websites not supporting TLS 1.2 but it was not done for compatibility with Java.
Eric Schmidt chimes in (Score:2, Interesting)
"Android is more secure than iPhone."
The proclamation was made during a question-and-answer session at the Gartner Symposium/ITxpo, where it drew laughter from the attending audience.
http://tech2.in.com/news/smartphones/eric-schmidt-calls-android-more-secure-than-iphone/917208 [in.com]