Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why SSL was renamed to TLS in late 90s (2014)

tim.dierks.org

Post reply on HN
Print view View original

191–200 of 237 posts

Re: Why SSL was renamed to TLS in late 90s (2014)

#191

Post by aaronbaugher »

account42 wrote: post #145
Timothycquinn wrote: post #66

Considering that Microsoft was a completely different beast in that time, I'm not surprised it does not seem that silly. M$ (appropriate name for that time) of the day was doing its best to own everything and the did not let up on trying to hold back the open source internet technologies until the early 2010's I believe. Its my opinion that they were successful in killing Java Applets, which were never able to improv…

Microsoft hasn't really changed that much besides getting a better PR department.

It also has a lot more competition in the Evil Big Tech Co space than it used to.

Re: Why SSL was renamed to TLS in late 90s (2014)

#192

Post by vladvasiliu »

Sophira wrote: post #168
ekr____ wrote: post #165

Earlier quoted context omitted.

This seems like a truly unreasonable level of political skill for nearly any setting. We're talking about changing every endpoint in the Internet, including those which can no longer be upgraded. I struggle to think of any entity or set of entities which could plausibly do that. Moreover, even in the best case scenario this means that you don't get the benefits of deployment for years if not decades. Even 7 years out…

> This seems like a truly unreasonable level of political skill for nearly any setting. We're talking about changing every endpoint in the Internet, including those which can no longer be upgraded. I struggle to think of any entity or set of entities which could plausibly do that. Case in point: IPv6 adoption. There's no interoperability or negotiation between it and IPv4 (at least, not in any way that matters), whic…

Many servers and clients support both ipv4 and ipv6. So, in a sense, there's a "negotiation" happening between client and server.

Re: Why SSL was renamed to TLS in late 90s (2014)

#193

Post by cubes »

albert_e wrote: post #21

Related Randomness and the Netscape Browser January 1996 Dr. Dobb's Journal https://people.eecs.berkeley.edu/~daw/papers/ddj-netscape.ht... This was written in 1996. The language used feels already much different from today's publications. God I feel old.

The authors of that article got pictured on the cover of the New York Times for finding that security issue: https://www.nytimes.com/2012/02/15/technology/researchers-fi...

Re: Why SSL was renamed to TLS in late 90s (2014)

#194

Post by matthewdgreen »

mcpherrinm wrote: post #92
cortesoft wrote: post #84

Earlier quoted context omitted.

> Each of these protocols has been designed so that you could automatically negotiate versions, thus allowing for clients and servers to independently upgrade without loss of connectivity. And ensuring decades of various downgrade attacks

The downgrade attacks on TLS are only really present in the case of client behaviour where, on failing to achieve one version, they retry a new connection without it. This was necessary to bypass various broken server side implementations, and broken middleboxes, but wasn’t necessarily a flaw in TLS itself. But from the learnings of this issue preventing 1.2 deployment, TLS 1.3 goes out of its way to look very simila…

This isn't really accurate historically. TLS has both ciphersuite and version negotiation. Logjam (2015) [1] was a downgrade attack on the former that's now fixed, but is an extension of an attack that was first noticed way back in 1996 [2]. Similar problems occurred with the FREAK attack, though that was actually a client vulnerability. TLS 1.3 goes out of its way to fix all of this using a better negotiation mechanism, and by reducing agility.

[1] https://en.wikipedia.org/wiki/Logjam_(computer_security) [2] https://www.usenix.org/legacy/publications/library/proceedin...

Re: Why SSL was renamed to TLS in late 90s (2014)

#195

Post by sillystu04 »

account42 wrote: post #145
Timothycquinn wrote: post #66

Considering that Microsoft was a completely different beast in that time, I'm not surprised it does not seem that silly. M$ (appropriate name for that time) of the day was doing its best to own everything and the did not let up on trying to hold back the open source internet technologies until the early 2010's I believe. Its my opinion that they were successful in killing Java Applets, which were never able to improv…

Microsoft hasn't really changed that much besides getting a better PR department.

They've adopted a different flavour of devilishness. See VSCode versus Visual Studio, or their approach to AI.

Bill Gates would've bought OpenAI. Satya shares their mission of developing AI for the good of humanity. He charitably donated billions of dollars in Azure credits in exchange for nothing besides a voice at the table and a license to help enable other organisations use AI through MS services.

In a way it's a PR difference, but I feel that understates the change.

Re: Why SSL was renamed to TLS in late 90s (2014)

#196

Post by throwaway843 »

slt2021 wrote: post #82
israrkhan wrote: post #78

Earlier quoted context omitted.

I think most people call it SSL because they use OpenSSL library to deal with secure communication have SSL in their names. Openssl being the most dominant one). Other libraries are BoringSSL, LibreSSL, wolfSSL etc. Libraries with TLS in their names are less frequently used GnuTLS, mbedTLS, s2n-tls and RustTLS.

SSL is used in websites. TlS is used in other applications, as in mTLS

Unfortunately you were voted down for answering OP.

SSL for websies, TLS for email, tunnels, XMPP, etc.

Re: Why SSL was renamed to TLS in late 90s (2014)

#197

Post by upofadown »

drob518 wrote: post #180
upofadown wrote: post #159

Earlier quoted context omitted.

Well you can , but that would require a higher level of political skill than normally exists for such things. What would have to happen is that almost everyone would have to agree on the new version and then implement it. Once implementation was sufficiently high enough then you have a switchover day. The big risk with such an approach is that you could implement something, then the politics could fail and you would…

That’s a great theory but in practice such a “flag day” almost never happens. The last time the internet went through such a change was January 1, 1983, when the ARPANET switched from NCP to the newly designed TCP/IP. People want to do something similar on February 1, 2030, to remove IPv4 and switch totally to IPv6, but I give it a 50/50 chance of success, and IPv6 is already about 30 years old. See https://ipv4flagd…

You don't have to have everyone switch over on the same day as with your example. Once it is decreed that implementations are widespread enough, then everyone can switch over to the introduced thing gradually. The "flag day" is when it is decreed that implementations no longer have to support some previously widely used method. Support for that method would then gradually disappear unless there was some associated cryptographic emergency that could not be dealt with without changing the standard.

Re: Why SSL was renamed to TLS in late 90s (2014)

#198

Post by lukas099 »

notpushkin wrote: post #80
Timothycquinn wrote: post #66

Considering that Microsoft was a completely different beast in that time, I'm not surprised it does not seem that silly. M$ (appropriate name for that time) of the day was doing its best to own everything and the did not let up on trying to hold back the open source internet technologies until the early 2010's I believe. Its my opinion that they were successful in killing Java Applets, which were never able to improv…

> M$ (appropriate name for that time) It’s even more appropriate nowadays, I’d say.

M$ used to be an appropriate name for Microsoft. It still is, but it used to be, too.

Re: Why SSL was renamed to TLS in late 90s (2014)

#199

Post by marcosdumay »

1over137 wrote: post #102
ekr____ wrote: post #61

The situation is additionally confused by the fact that the version numbers do not give a good clue to how different the protocols were. Specifically: SSLv2 was the first widely deployed version of SSL, but as this post indicates, had a number of issues. SSLv3 is a more or less completely new protocol TLS 1.0 is much like SSLv3 but with some small revisions made during the IETF standardization process. TLS 1.1 is a r…

Well, at least they were not just versioned by year number. ;)

It would still be better than changing the name for no reason and resetting the version number.

Re: Why SSL was renamed to TLS in late 90s (2014)

#200

Post by happyopossum »

vladvasiliu wrote: post #192
Sophira wrote: post #168

Earlier quoted context omitted.

> This seems like a truly unreasonable level of political skill for nearly any setting. We're talking about changing every endpoint in the Internet, including those which can no longer be upgraded. I struggle to think of any entity or set of entities which could plausibly do that. Case in point: IPv6 adoption. There's no interoperability or negotiation between it and IPv4 (at least, not in any way that matters), whic…

Many servers and clients support both ipv4 and ipv6. So, in a sense, there's a "negotiation" happening between client and server.

That’s not negotiating- I can’t connect to a server over v4 and have it tell me to switch to v6 or vice versa. That’s just supporting 2 completely different protocols.
Post reply on HN