[embik]

It would be helpful if the post not only told you what to _not_ do (especially when it is a frequently done thing) but offered any sort of alternative.

[RedShift1]

Probably a generalization but in my experience many IT security people don't seem very pragmatic. "No you can't do that" but no alternative. "No don't use that cipher" but can't tell you the correct one. "Don't use equipment that doesn't receive firmware updates anymore and doesn't support newer encryption standards". "Don't allow mDNS" so no more printing from smartphones or presenting stuff from your laptop using Miracast? It gets tiresome really fast.

Edit: yeah sure downvote me into oblivion. I'm not throwing away perfectly functional equipment because it doesn't support the latest and greatest ciphersuite. I'm also not planning on a being a roadblock on everything, it's balancing act.

[PrimeMcFly]

> so no more printing from smartphones or presenting stuff from your laptop using Miracast? It gets tiresome really fast.

You can still print from a phone or present from a laptop, just not with solutions relying on insecure services.

It requires some effort is all.

[andybak]

Cookie based session logins like everyone used to use?

[embik]

Not everyone can look back at a 10 year long career in the industry to draw inspiration from. Especially for junior engineers, pointing out alternatives (that feel obvious to you) would be important.

[sleepyhead]

Can’t be used when embedding on third party sites though.

[sam_lowry_]

I work for ab EU government, and cookies are a no-go because of cookies directive, so we use JWT and auth the javscript engine, not the browser.

This leads to a multitude if problems, but who cares?

[user3939382]

PASETO?