The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec
protocols and other protocols and products, have a birthday bound of
approximately four billion blocks, which makes it easier for remote
attackers to obtain cleartext data via a birthday attack against a
long-duration encrypted session, as demonstrated by an HTTPS session using
Triple DES in CBC mode, aka a "Sweet32" attack.

 mdeslaur> DES ciphers aren't typically selected as there are other
 mdeslaur> stronger ciphers placed earlier in default cipher lists
 mdeslaur> gnutls puts AES before 3DES in the cipher list