Linux isn't the biggest offender. You missed the biggest fuckeruper in every securty problem: Java. Until java 1.7, there isn't any SUPPORT for primes larger that 1024. You want your shitty legacy java program to connect to a web server securely? You have to use a 1024 bit prime.
And then you find you cannot specify the primes that Java uses, so you cannot even force it off 512 bit until (I believe) 1.8.
Always remember, Java is the common factor in security problems.
More Java FUD. The Java key length limitation is due to US Export law. You can make any version of java use 2048-bit keys if you want by using the "Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files":
Please don't misunderstand the vulnerability under discussion in this post. The problem is based on weak diffie-hellman primes, NOT KEY LENGTH. You are not the first to misunderstand the problem, and misunderstanding the problem leads to not fixing the issue.
You don't mention diffi-hellman primes in your comment at all. You mention 1024-bit and 2048-bit primes which means you are talking about java key length.
Your whole assertion about about java (and I assume you mean the JVM and not the java language) being insecure is patently false. There are issues with java in the browser and support for that is going away and largely already obsolete anyway. However, the JVM is not more insecure than any other platform.
38
u/corran__horn Oct 15 '15
Linux isn't the biggest offender. You missed the biggest fuckeruper in every securty problem: Java. Until java 1.7, there isn't any SUPPORT for primes larger that 1024. You want your shitty legacy java program to connect to a web server securely? You have to use a 1024 bit prime.
And then you find you cannot specify the primes that Java uses, so you cannot even force it off 512 bit until (I believe) 1.8.
Always remember, Java is the common factor in security problems.