Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why SSL was renamed to TLS in late 90s (2014)

tim.dierks.org

Post reply on HN
Print view View original

61–70 of 237 posts

Re: Why SSL was renamed to TLS in late 90s (2014)

#61

Post by ekr____ »

The situation is additionally confused by the fact that the version numbers do not give a good clue to how different the protocols were. Specifically:

SSLv2 was the first widely deployed version of SSL, but as this post indicates, had a number of issues.

SSLv3 is a more or less completely new protocol

TLS 1.0 is much like SSLv3 but with some small revisions made during the IETF standardization process.

TLS 1.1 is a really minor revision to TLS 1.0 to address some issues with the way block ciphers were used.

TLS 1.2 is a moderately sized revision to TLS 1.1 to adjust to advances in cryptography, specifically adding support for newer hashes in response to weaknesses in MD5 and SHA-1 and adding support for AEAD cipher suites such as AES-GCM.

TLS 1.3 is mostly a new protocol though it reuses some pieces of TLS 1.2 and before.

Each of these protocols has been designed so that you could automatically negotiate versions, thus allowing for clients and servers to independently upgrade without loss of connectivity.

Re: Why SSL was renamed to TLS in late 90s (2014)

#62

Post by ekr____ »

userbinator wrote: post #3

tl;dr: politics. I still like to occasionally refer to TLS 1.3 as "SSL 3.4" to see whether people are aware of the history.

When TLS 1.3 was finally standardized, there was quite a bit of debate about whether in light of the how different it was from TLS 1.2 we should continue to use the 1.3 version number. ISTR that TLS 2 and TLS 4.0 were both floated--though I don't recall SSL 3.4--but eventually the WG decided to stick with the 1.3 version number we had been using throughout the rest of the process.

Re: Why SSL was renamed to TLS in late 90s (2014)

#63

Post by II2II »

TZubiri wrote: post #8
chollida1 wrote: post #6

> As a part of the cutthroat competition, Microsoft decided to revise the SSL 2 protocol with some additions of their own, and specified a protocol called "PCT" that was derived from SSL 2. It was only supported in IE and IIS. > Netscape also wanted to address SSL 2 issues, but wasn't going to let Microsoft take leadership/ownership in the standard, so they developed SSL 3.0, which was a more significant departure. I…

Microsoft was the bad guy in a movie where you have a war right before aliens invade and you figure out that there's bigger enemies. FSF hated Microsoft because they released binaries without source code, they were THE enemy, nowadays, you are lucky if you get a binary to study and modify! The standard from any competitive developer is to hide the binary and source behind a server. Try to study and modify that!

For the FSF, Microsoft releasing binaries without source was reason enough to hat them but it was not the only reason why people, including those in the FSF, hated them. Microsoft was very much a company that used their dominant market position to lock customers in and the competition out. (Remember embraced, extend, extinguish?) The Microsoft of today looks like a cuddly teddy bear in comparision.

Re: Why SSL was renamed to TLS in late 90s (2014)

#64

Post by anal_reactor »

jedberg wrote: post #27

Curious, when you tell someone they need to access a website securely (or any other case where you might use the term TLS or SSL), do you: 1. Say SSL or TLS? 2. How old are you (or did you start working before 1999?) I'll reply with my answer too.

I always say HTTPS because in the context of my area of speciality, the details of how HTTPS works don't matter and neither do secure communication protocols besides HTTPS.

Re: Why SSL was renamed to TLS in late 90s (2014)

#65

Post by userbinator »

ekr____ wrote: post #62
userbinator wrote: post #3

tl;dr: politics. I still like to occasionally refer to TLS 1.3 as "SSL 3.4" to see whether people are aware of the history.

When TLS 1.3 was finally standardized, there was quite a bit of debate about whether in light of the how different it was from TLS 1.2 we should continue to use the 1.3 version number. ISTR that TLS 2 and TLS 4.0 were both floated--though I don't recall SSL 3.4--but eventually the WG decided to stick with the 1.3 version number we had been using throughout the rest of the process.

The version number in the protocol for TLS 1.3 is 03 04. TLS 1.0 is 03 01, and SSL 3.0 is 03 00. Hence "SSL 3.4".

Re: Why SSL was renamed to TLS in late 90s (2014)

#66

Post by Timothycquinn »

Considering that Microsoft was a completely different beast in that time, I'm not surprised it does not seem that silly.

M$ (appropriate name for that time) of the day was doing its best to own everything and the did not let up on trying to hold back the open source internet technologies until the early 2010's I believe. Its my opinion that they were successful in killing Java Applets, which were never able to improve past the first versions and JavaScript and CSS in general was held back many years.

I still recall my corporate overloards trying to push me to support IE's latest 'technologies' but I resisted and instead started supporting Mozilla 3.0 as soon as they fixed some core JS bugs for our custom built enterprise JavaScript SPA tools in the early 2000's. It turned out to be a great decision as the fortune 500 company started using Mozilla / Firefox in other internal apps in later years long before it became common place.

Re: Why SSL was renamed to TLS in late 90s (2014)

#67

Post by esafak »

II2II wrote: post #63
TZubiri wrote: post #8

Earlier quoted context omitted.

Microsoft was the bad guy in a movie where you have a war right before aliens invade and you figure out that there's bigger enemies. FSF hated Microsoft because they released binaries without source code, they were THE enemy, nowadays, you are lucky if you get a binary to study and modify! The standard from any competitive developer is to hide the binary and source behind a server. Try to study and modify that!

For the FSF, Microsoft releasing binaries without source was reason enough to hat them but it was not the only reason why people, including those in the FSF, hated them. Microsoft was very much a company that used their dominant market position to lock customers in and the competition out. (Remember embraced, extend, extinguish?) The Microsoft of today looks like a cuddly teddy bear in comparision.

Microsoft's motto then was "We set the standards".

Re: Why SSL was renamed to TLS in late 90s (2014)

#68

Post by rendx »

chollida1 wrote: post #6

> As a part of the cutthroat competition, Microsoft decided to revise the SSL 2 protocol with some additions of their own, and specified a protocol called "PCT" that was derived from SSL 2. It was only supported in IE and IIS. > Netscape also wanted to address SSL 2 issues, but wasn't going to let Microsoft take leadership/ownership in the standard, so they developed SSL 3.0, which was a more significant departure. I…

> But Netscape in this instance acted like kids

Oh, please.

https://en.wikipedia.org/wiki/Criticism_of_Microsoft

The "velvet sweatshop" one is sufficient, but plenty of others to choose from. Don't have a source at hand but I remember it was known for its "work 3 years there and then you need to retire early from burnout" culture. There's also a really good (and highly depressing) 2001 German documentary around that "feature" called "Leben nach Microsoft" (Life after Microsoft).

And the classic https://en.wikipedia.org/wiki/Microserfs

There was really less than zero reason to trust M$ in the 90s and early 00s.

Re: Why SSL was renamed to TLS in late 90s (2014)

#69

Post by achillean »

There are still more than 300,000 services on the Internet that support SSLv2:

https://www.shodan.io/search/report?query=ssl.version%3Asslv...

And a trend line of how it's changed:

https://trends.shodan.io/search?query=ssl.version%3Asslv2#ov...

It has dropped significantly though over the years but it will continue to stick around for a while.

Re: Why SSL was renamed to TLS in late 90s (2014)

#70

Post by webprofusion »

People who make a strong distinction between TLS and SSL are indicating that they know the difference and think you should too, but at a practical level it's the difference between .doc and .docx (fundamentally different but interchangeable to the layman). The boots on the ground mostly care about getting https to work and have minimal consideration for it's inner workings.
Post reply on HN