How? I would expect anything that might identify the browser would be sent *afte... | Hacker News

Hacker News new | past | comments | ask | show | jobs | submit

login

tbrownaw on Sept 6, 2014 | parent | context | favorite | on: Gradually sunsetting SHA-1

How? I would expect anything that might identify the browser would be sent after the encryption was set up?

bzbarsky on Sept 6, 2014 [–]

The list of supported cyphersuites is sent before the encryption is set up.

Though some browsers lie in that list and list things they don't actually support, of course...

Join us for AI Startup School this June 16-17 in San Francisco!
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact