4 ms·

Yes, SSL has been broken for some time. That's why TLS was introduced nearly 20 years ago.

dpark 9y ago
You presumably got downvoted for being pedantic here, but I think your pedantry is reasonable. If someone's going say "X is fundamentally broken", they should know what X is actually called. Referring to TLS as SSL reeks of amateur hour and shallow knowledge[1], and is a mistake on par with referring to Javascript as Java. [1] This is the sort of lazy mistake I would make, because I'm not a security expert.
- cup-of-tea 9y ago
  The first line of the blog post calls it SSL. It's irrelevant to what I said because I'm talking about the public key infrastructure.
  - dpark 9y ago
    The blog author is also not a security expert. And I understand that your real criticism was with PKI. That makes it even worse that you called it SSL. Again, I feel like you're showing your lack of expertise in this area. I'm not an expert at all in this area and yet even I can recognize that you're playing armchair security expert.
  - peterwwillis 9y ago
    SSL/TLS are just protocols, they aren't infrastructure. There's a lot of moving parts in the infrastructure that are not these protocols. The protocols work pretty well.
- zaarn 9y ago
  While not a security expert, I frequently refer to TLS as SSL, mostly when I talk about encrypted connections in general rather than specific protocol versions. It's not quite as bad as calling JS Java or vice versa, it's more like saying Java and then saying Java 1.2 and Java 1.8 and so forth.
  - yjftsjthsd-h 9y ago
    Or better yet, it's like calling it Java 8 and then someone says you don't know what you're talking about because it's technically Java 1.8.
- jlgaddis 9y ago
  Yes, technically it's TLS, not SSL. TLS, however, is an "evolution" of SSL and many, many people still use this nomenclature. It doesn't "reek of amateur hour and shallow knowledge", it's just a holdover from the past. We all know and understand what others are referring to when they say "SSL". It's like when I tell the girlfriend I'm going to go on a "bike ride". She understands that I mean I'm going for a ride on my Harley, a motorcycle, and not an actual bicycle. Or last weekend, when a friend asked me, "Hey, could you move your car so <other person> can get out?". While I could have stood there arguing with him or correcting him (since my car was actually at home, in my driveway), I instead went out and moved my truck so that the other guest could leave. This excessive, unwarranted pedantry is annoying as hell. You may be "technically correct" but you make everyone around you dislike you.
  - dpark 9y ago
    Your examples are not really comparable, mostly because of context. If someone at a party mentions SSL casually and you feel the need to explain that SSL is dead and they are really talking about TLS, you're just annoying. If someone presents themselves as an expert and says that SSL is "fundamentally broken", it's pretty reasonable to question their expertise. Especially when they actually aren't even talking about TLS but about CAs and PKI. To make an absolute statement about the fundamental soundness of PKI and then use completely the wrong term? Come on. Can you imagine a real expert doing this and not at least recognize their own mistake? Don't talk about "fundamental flaws" when you don't know the difference between SSL and TLS and PKI. This is very much like someone trying to criticize the design of TCP/IP and not knowing the difference between an IP address and a MAC address.
  - Tijdreiziger 9y ago
    > It's like when I tell the girlfriend I'm going to go on a "bike ride". She understands that I mean I'm going for a ride on my Harley, a motorcycle, and not an actual bicycle. Try saying this in the Netherlands (or, presumably, Denmark). Everyone would be surprised when you bring out your motorcycle instead of your bike (i.e., bicycle).

You presumably got downvoted for being pedantic here, but I think your pedantry is reasonable. If someone's going say "X is fundamentally broken", they should know what X is actually called. Referring to TLS as SSL reeks of amateur hour and shallow knowledge[1], and is a mistake on par with referring to Javascript as Java. [1] This is the sort of lazy mistake I would make, because I'm not a security expert.

cup-of-tea 9y ago
The first line of the blog post calls it SSL. It's irrelevant to what I said because I'm talking about the public key infrastructure.
- dpark 9y ago
  The blog author is also not a security expert. And I understand that your real criticism was with PKI. That makes it even worse that you called it SSL. Again, I feel like you're showing your lack of expertise in this area. I'm not an expert at all in this area and yet even I can recognize that you're playing armchair security expert.
- peterwwillis 9y ago
  SSL/TLS are just protocols, they aren't infrastructure. There's a lot of moving parts in the infrastructure that are not these protocols. The protocols work pretty well.
zaarn 9y ago
While not a security expert, I frequently refer to TLS as SSL, mostly when I talk about encrypted connections in general rather than specific protocol versions. It's not quite as bad as calling JS Java or vice versa, it's more like saying Java and then saying Java 1.2 and Java 1.8 and so forth.
- yjftsjthsd-h 9y ago
  Or better yet, it's like calling it Java 8 and then someone says you don't know what you're talking about because it's technically Java 1.8.
jlgaddis 9y ago
Yes, technically it's TLS, not SSL. TLS, however, is an "evolution" of SSL and many, many people still use this nomenclature. It doesn't "reek of amateur hour and shallow knowledge", it's just a holdover from the past. We all know and understand what others are referring to when they say "SSL". It's like when I tell the girlfriend I'm going to go on a "bike ride". She understands that I mean I'm going for a ride on my Harley, a motorcycle, and not an actual bicycle. Or last weekend, when a friend asked me, "Hey, could you move your car so <other person> can get out?". While I could have stood there arguing with him or correcting him (since my car was actually at home, in my driveway), I instead went out and moved my truck so that the other guest could leave. This excessive, unwarranted pedantry is annoying as hell. You may be "technically correct" but you make everyone around you dislike you.
- dpark 9y ago
  Your examples are not really comparable, mostly because of context. If someone at a party mentions SSL casually and you feel the need to explain that SSL is dead and they are really talking about TLS, you're just annoying. If someone presents themselves as an expert and says that SSL is "fundamentally broken", it's pretty reasonable to question their expertise. Especially when they actually aren't even talking about TLS but about CAs and PKI. To make an absolute statement about the fundamental soundness of PKI and then use completely the wrong term? Come on. Can you imagine a real expert doing this and not at least recognize their own mistake? Don't talk about "fundamental flaws" when you don't know the difference between SSL and TLS and PKI. This is very much like someone trying to criticize the design of TCP/IP and not knowing the difference between an IP address and a MAC address.
- Tijdreiziger 9y ago
  > It's like when I tell the girlfriend I'm going to go on a "bike ride". She understands that I mean I'm going for a ride on my Harley, a motorcycle, and not an actual bicycle. Try saying this in the Netherlands (or, presumably, Denmark). Everyone would be surprised when you bring out your motorcycle instead of your bike (i.e., bicycle).