[mtmail]

Amazon.com seems to still supports TLS 1.0 and 1.1, older less secure protocols.

Newest operating system no longer enable TLS 1.0 or 1.1. Without three hacks an Ubuntu 20 won't allow any connections with those ciphers. While on the other hand older operating systems like Windows 7 don't understand TLS 1.2 and can't be upgraded.

So apart from HTML when it comes to secure HTTPS connection all security advice is to no longer allow outdated ciphers. 5 years in the future I'd expect old browsers to longer be able to access most internet websites.

[toast0]

Following security advice blindly is never a great idea. I don't think modern browsers will fall back below TLS 1.2 anymore (or at least not automatically), so offering support for TLS 1.0 doesn't impact them.

Then the question is what do you want to do with older browsers? Do you want to give them a browser error that users probably can't understand or do you want to let them in and shop?

[gtirloni]

Definitely let them shop. The per-account security issues created by old ciphers will be a rounding error in Amazon's risk management budget.