Yesterday, Google announced a serious exploit in the 15-year old SSL 3.0 design.

It is called the POODLE Attack, which stands for Padding Oracle On Downgraded Legacy Encryption. It is a “man in the middle” exploit which takes advantage of web browsers’ fallback to SSL 3.0. You can read all the technical details in this Google paper.

Google said the solution is to not support it.

Google said in the coming months they will disable SSL 3.0 support completely from their products.

You can read a lot more about this at Techmeme.

I do wonder if Google’s search results will start labeling sites with SSL 3.0 issues.

Forum discussion at WebmasterWorld.