Hacker News new | ask | show | jobs
by memory_grep 2940 days ago
the ones that do support HTTPS don’t support SSL (they only support TLS, the old standard having severe security flaws)

Isn't TLS the successor to SSL?

1 comments

Yes, but I think your parent's point is that the sites which enable HTTPS _did_ choose to remove support for known-broken protocols versions, so you've got on the one hand people who cared at all, all doing something vaguely modern and secure, and people who did nothing (plain HTTP), with no security.

You can think of TLS 1.0 as essentially SSLv3.1, with TLS 1.1 and TLS 1.2 then as SSLv3.2 and SSLv3.3

And you might think of this as the normal course of any versioned system - tinnier and tinnier changes, except TLS 1.3 (now awaiting publication) is basically completely fresh, it only looks similar on the wire until encryption switches on, in order to maximise compatibility with legacy middleboxes, once it penetrates the middleboxes it's nothing like SSLv3.