Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What 5-year-old device only supports older than TLS 1.2? (I assume that's what you meant by "older HTTPS versions".)


I understand your skepticism, but I'm coming from years of actual testing on many real-world devices that people use everyday and have no agency in upgrading for various reasons.

As I mentioned in other comments, there are many possible areas where HTTPS can present a barrier to a user's access to your resource. Some of these I listed in another comment, which I copy below:

---

Only a few of the barriers presented by HTTPS:

Clock sync would be a requirement for access.

A recent device would be a requirement for access (not everyone can afford a new one).

Site admin keeping up with certificate registration would be a requirement.

Approval from the centralized certificate authority would be a requirement.

Server's self domain name matching accessed domain name would be a requirement.

These are all real scenarios where real people can be denied access to information that is crucial to them, up to the point of survival.

Just a few of the reasons why all my websites still allow HTTP.

HTTP is also way faster on slow connections.

---

https://news.ycombinator.com/item?id=35800566


That doesn't answer what I asked at all, and I already rebutted those points in the other place you posted that: https://news.ycombinator.com/item?id=36597183




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: