[Avamander]

> You alert the user, problem solved.

How do you alert the users that are running the problematic software and haven't yet updated it? The very premise is ridiculous.

> What really happens is someone has a 20 year old mail no matter what, itcwill always exist, and the choice is, support it or not. Support it to be read, support it to be converted, warn the user, suggest fixes.

Well yeah and the choice should be to not support it. If the user needs those letters they can either decrypt or just re-encrypt them. It's silly to claim that a message can somehow be both so vital to be protected by encryption, but not upgraded to something more modern.

> And your SSL example is senseless! In what world do you envision super secure stuff alongside weaker legacy, on the same damned server.

I'm not envisioning it. Nobody should be running such old useless garbage. What was suggested earlier in this thread does not work and must not happen in practice.

[b112]

How do you alert the users that are running the problematic software and haven't yet updated it? The very premise is ridiculous.

Where did you get the weird idea the software isn't updated? This entire discussion is about deprecation of older encryption methods in new versions of software.

You're not giving this thought. Good day.

[kazinator]

Yes, but that is only needed to connect with old software that has not updated. Two pieces of new software will not negotiate on using old crypto even if they both support it.

In the trouble situations, one of the two pieces of software being upgraded is thrust upon the user.