3 ms·
Time and again telecoms continue to pull these types of shenanigans. If you are building a website in 2018 using https with hsts enabled is a must.
by pg_bot 9y ago
Time and again telecoms continue to pull these types of shenanigans. If you are building a website in 2018 using https with hsts enabled is a must.
- walrus01 9y agoThat, and there is little excuse not to set apache2 or nginx to only allow tls1.2 with the best choices in crypto options. The population of client browsers that are so old they don't do 1.2 is extremely tiny. https://httpd.apache.org/docs/trunk/ssl/ssl_howto.html https://httpd.apache.org/docs/trunk/ssl/ssl_howto.html
- spydum 9y agoI was going to argue with you, but stats do indeed seem to back this up (I hadn't looked at them in at least a year or two). The gains for chrome are insane, and there is clearly a harsh decline for IE. I suppose this is probably why PCI-DSS felt it appropriate to push hard into deprecating TLS1.0 and TLS1.1 (without negatively affecting users too harshly).
- walrus01 9y agoYeah, pretty much any browser that was newly installed or updated from late 2012 onwards has tls1.2 support. The population of browsers older than that is <1% at present.