7 ms·

If you're interested in real-world SSL/TLS stats (updated monthly): https://www.ssllabs.com/ssl-pulse/ https://www.ssllabs.com/ssl-pulse/ Feb 2021 data: - 99

If you're interested in real-world SSL/TLS stats (updated monthly): https://www.ssllabs.com/ssl-pulse/ https://www.ssllabs.com/ssl-pulse/ Feb 2021 data: - 99.3% sites support TLS 1.2 (or better) - 42.9% sites support TLS 1.3 - 0.7% sites support only TLS 1.0

moviuro 6y ago
And for the client-side: 90.29% support according to [0] [0] https://caniuse.com/tls1-3 https://caniuse.com/tls1-3
- oaiey 6y ago
  When you are in a browser. API calls are not evergreen as Browsers are.
  - croutonwagon 6y ago
    Same with compiled applications. Windows is the clear laggard here but still https://docs.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp- https://docs.microsoft.com/en-us/windows/win32/secauthn/prot... .Net says to use the OS schannel protocols. Even the latest Windows doesnt do TLS 1.3 yet. MSSQL has no support for it either. Even on the end user side. One i like to point out is disable TLS 1.0 and try and launch discord. Their update cdn only supports TLS 1.0. So the application doesnt function unless the OS client also will use TLS 1.0 I opened a ticket with them about it and was marked solved and responded with. >Sadly, this is currently working as intended. However, if you would like to see changes to these systems in the future, then you can definitely vote up the suggestions at feedback.discordapp.com. We are a long way from removing TLS 1.0.
    - pitterpatter 6y ago
      Some details missing on that page: Windows supports TLS 1.3 as of version 1903 [1], just disabled by default. I believe it's enabled by default in insider builds as of this summer. [1] https://devblogs.microsoft.com/premier-developer/microsoft-tls-1-3-support-reference/ https://devblogs.microsoft.com/premier-developer/microsoft-t...
      - croutonwagon 6y ago
        Thats where "supported as in can the OS attempt to use it" and "supported as in stable and ready for prod" are diverged. Also the link in that document is unsurprisingly 404'd. If only IIS had a method of doing redirects and rewrites :? https://web.archive.org/web/20200327011332/https://docs.microsoft.com/en-us/windows/release-information/status-windows-10-1903 https://web.archive.org/web/20200327011332/https://docs.micr...
hi41 6y ago
Could you please ELI5 the difference between ssl and tls. My office is also moving to tls 1.2 and the communication seemed to use both ssl and tls interchangeably. The Winndows registry has entrees for both ssl and tls. I am confused.
- unethical_ban 6y ago
  The confusion is understandable. _TECHNICALLY_ the only thing that exists is TLS. The implementation history is SSL 3.0 < TLS 1.0 ... 1.3 However, SSL is still used colloquially in conversation, e.g. "SSL certificate" and in many legacy config flags, such as Firefox's `about:config`. For best clarity, check the details of all those settings, even the SSL ones. But TLS is the term for the modern standards.
- wolf550e 6y ago
  There is no difference. SSL was invented by Netscape, when they brought it to IETF to get standardized Microsoft did not want to use a name Netscape has advertised, so they forced a name change. Thus "SSL 3.1" (IETF update to SSL 3) was called "TLS 1.0". This was in 1999. TLS 1.1 uses version encoded in two bytes that should mean "SSL 3.2", TLS 1.2 uses bytes that should mean "SSL 3.3". TLS 1.3 pretends to be TLS 1.2 to pass through proxies but internally uses two bytes that should mean SSL 3.4 to indicate its version.
- deleted 6y ago
  [deleted]
- Legion 6y ago
  SSL = TLS version 0.x. Earlier versions of the same thing. Colloquially we still say "SSL" a lot when referring to TLS.
  - andrewnicolalde 6y ago
    This is one of my greatest pet peeves, hearing people ask for "SSL certificates" and seeing "your payment card information is secured with SSL" at the bottom of websites everywhere. I know it really doesn't matter in the grand scheme of things, but man does it make my eye twitch lol.

moviuro 6y ago

And for the client-side: 90.29% support according to [0] [0] https://caniuse.com/tls1-3 https://caniuse.com/tls1-3

oaiey 6y ago
When you are in a browser. API calls are not evergreen as Browsers are.
- croutonwagon 6y ago
  Same with compiled applications. Windows is the clear laggard here but still https://docs.microsoft.com/en-us/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp- https://docs.microsoft.com/en-us/windows/win32/secauthn/prot... .Net says to use the OS schannel protocols. Even the latest Windows doesnt do TLS 1.3 yet. MSSQL has no support for it either. Even on the end user side. One i like to point out is disable TLS 1.0 and try and launch discord. Their update cdn only supports TLS 1.0. So the application doesnt function unless the OS client also will use TLS 1.0 I opened a ticket with them about it and was marked solved and responded with. >Sadly, this is currently working as intended. However, if you would like to see changes to these systems in the future, then you can definitely vote up the suggestions at feedback.discordapp.com. We are a long way from removing TLS 1.0.
  - pitterpatter 6y ago
    Some details missing on that page: Windows supports TLS 1.3 as of version 1903 [1], just disabled by default. I believe it's enabled by default in insider builds as of this summer. [1] https://devblogs.microsoft.com/premier-developer/microsoft-tls-1-3-support-reference/ https://devblogs.microsoft.com/premier-developer/microsoft-t...
    - croutonwagon 6y ago
      Thats where "supported as in can the OS attempt to use it" and "supported as in stable and ready for prod" are diverged. Also the link in that document is unsurprisingly 404'd. If only IIS had a method of doing redirects and rewrites :? https://web.archive.org/web/20200327011332/https://docs.microsoft.com/en-us/windows/release-information/status-windows-10-1903 https://web.archive.org/web/20200327011332/https://docs.micr...

hi41 6y ago

Could you please ELI5 the difference between ssl and tls. My office is also moving to tls 1.2 and the communication seemed to use both ssl and tls interchangeably. The Winndows registry has entrees for both ssl and tls. I am confused.

unethical_ban 6y ago
The confusion is understandable. _TECHNICALLY_ the only thing that exists is TLS. The implementation history is SSL 3.0 < TLS 1.0 ... 1.3 However, SSL is still used colloquially in conversation, e.g. "SSL certificate" and in many legacy config flags, such as Firefox's `about:config`. For best clarity, check the details of all those settings, even the SSL ones. But TLS is the term for the modern standards.
wolf550e 6y ago
There is no difference. SSL was invented by Netscape, when they brought it to IETF to get standardized Microsoft did not want to use a name Netscape has advertised, so they forced a name change. Thus "SSL 3.1" (IETF update to SSL 3) was called "TLS 1.0". This was in 1999. TLS 1.1 uses version encoded in two bytes that should mean "SSL 3.2", TLS 1.2 uses bytes that should mean "SSL 3.3". TLS 1.3 pretends to be TLS 1.2 to pass through proxies but internally uses two bytes that should mean SSL 3.4 to indicate its version.
deleted 6y ago
[deleted]
Legion 6y ago
SSL = TLS version 0.x. Earlier versions of the same thing. Colloquially we still say "SSL" a lot when referring to TLS.
- andrewnicolalde 6y ago
  This is one of my greatest pet peeves, hearing people ask for "SSL certificates" and seeing "your payment card information is secured with SSL" at the bottom of websites everywhere. I know it really doesn't matter in the grand scheme of things, but man does it make my eye twitch lol.