4 ms·
I recently did the opposite and re-enabled 1.0 and 1.1 Wrote some thoughts on why here https://blog.nyman.re/2021/02/07/usability-security.html https://blog.ny
by gnyman 6y ago
I recently did the opposite and re-enabled 1.0 and 1.1
Wrote some thoughts on why here https://blog.nyman.re/2021/02/07/usability-security.html https://blog.nyman.re/2021/02/07/usability-security.html but in short, it's several magnitudes more likely someone will want to check out my blog using a old device vs someone trying to exploit vulnerabilities in the old protocols.
Google.com still allows TLS1.0/1.1 https://www.ssllabs.com/ssltest/analyze.html?d=google.com&s=172.217.5.110&hideResults=on&ignoreMismatch=on https://www.ssllabs.com/ssltest/analyze.html?d=google.com&s=...
- lazyweb 6y agoYeah no, that's where I'd draw the line. I have one nginx instance serving my blog and various resources via proxypass (nextcloud, grafana, icinga, kibana etc.). For the sake of keeping things maintainable, there's one wildcard cert for my domain and one global SSL configuration. I'd rather shut out people with Windows XP than enabling < TLS 1.2 globally.
- gnyman 6y agoEveryone has different priorities of course. But note that as long as you use a modern client TLS_FALLBACK_SCSV will ensure you won't be at risk of downgrade attacks or similar. Without that I also don't think I would run it.