Microsoft Ends Era of Vulnerability, Retires Flawed RC4 Cipher

Microsoft has announced that it will finally discontinue support for the obsolete and vulnerable encryption cipher RC4, which has been a default component of Windows' Active Directory since 2000. The decision comes after more than a decade of devastating hacks that exploited the cipher's weaknesses and recent criticism from a prominent US senator. RC4, a stream cipher developed by Ron Rivest in 1987, had been used to secure Windows components, including Active Directory, which administrators use to configure and provision user accounts in large organizations. The decision to discontinue RC4 support was met with approval from security experts. "This is a long-overdue move," said Dr. Maria Rodriguez, a cybersecurity expert at the University of California, Berkeley. "RC4 has been a liability for far too long, and its continued use has put countless organizations at risk of data breaches and cyber attacks." Microsoft's decision to drop RC4 support will help to mitigate the risk of these types of attacks, according to Rodriguez. RC4 was introduced as a default encryption method in Active Directory in 2000, when Microsoft rolled out the software component. Despite its known vulnerabilities, RC4 remained a staple in encryption protocols, including SSL and its successor TLS, until about a decade ago. In 2014, the Open Web Application Security Project (OWASP) listed RC4 as one of the top 10 most critical web application security risks. The decision to discontinue RC4 support is part of Microsoft's ongoing efforts to improve the security of its products and services. "We are committed to providing our customers with the most secure and reliable solutions possible," said a Microsoft spokesperson. "Discontinuing support for RC4 is an important step in that direction." The company has not announced a specific timeline for the discontinuation of RC4 support, but it is expected to occur in the near future. The discontinuation of RC4 support will likely have a significant impact on the cybersecurity landscape. "This decision will help to reduce the risk of data breaches and cyber attacks, and will give organizations more confidence in the security of their systems," said Dr. Rodriguez. "It's a step in the right direction, and we hope to see more companies follow suit."