3

I asked a question today and Martijn let me know that I was using the wrong terminology when I was using HTTPS and SSL interchangably.

SSL version 3 was recently found to be insecure and now websites are turning off all SSL and moving to TLS.

and are currently both tag synonyms for here. This seems silly since SSL is now dead. Should we pick one of the other two to make the canonical preferred tag?

1
  • Since both proposals here start with making https the preferred tag for all existing questions, I've gone ahead and done that swap. I'd like more feedback on whether or not we should split out the SSL and TLS tags.
    – Stephen Ostermiller Mod
    Nov 21, 2014 at 23:13

2 Answers 2

Reset to default
1

To copy the info from my reply*:
*This was the quick version, covering a large part of the basics

SSL is not really supported anymore. The POODLE attack is again SSLv3, the solution is turning off SSL3. "But wait! Than what do I use, SSLv3 is the lastest version, should I go back to v2?!"

Nope. Modern browsers support TLSv1.0 to TLSv1.2 (1.0 has broad support, 1.1 and 1.2 not yet). It's fairly safe to turn off SSL, forcing browser to TLS (which, again, is the first try of mordern browsers anyways). The only browser which is gonna have a problem with that is: IE6.

IMO https, SSL and TLS are 3 different things. SSL and TLS are both related to https, but it's far from the same/synonym:

  • An https connection can be established via SSL (but really shouldn't), or
  • An https connection can be established via TLS (this is preferred)

I propose that we:

  1. Swap the tag synonyms for and to make all questions that are currently tagged into .
  2. Unlink the terms so that they are no longer synonyms. We should write descriptions for each in the tag wiki:
    • - Secure Sockets Layer (SSL) is a cryptographic protocol. The latest version (3) has security vulnerablities and should no longer be used. SSL has been replaced by (transport layer security).
    • - Transport Layer Security (TLS) is a cryptographic protocol that provides communications security over the Internet. It is used as the cryptography for connections to secure websites.
    • - HTTPS is the secure version of the hypertext transfer protocol (). It usually uses port 443 and is powered by the and cryptographic protocols.
8
  • 1
    If you are talking about TLS in the context of a website it would necessarily mean HTTPS though. In the context of a site for webmasters, HTTPS and TLS seem close enough to be considered synonyms for tagging purposes. Or do you think that people could ask questions about TLS here that wouldn't also be about HTTPS? Or questions about HTTPS that wouldn't imply that they were using TLS?
    – Stephen Ostermiller Mod
    Nov 12, 2014 at 15:51
  • If we do separate them, we would be left with lots of questions tagged SSL and none tagged HTTPS or TLS. If you still suggest separating them, should we first convert the SSL tag to HTTPS and then break the synonym?
    – Stephen Ostermiller Mod
    Nov 12, 2014 at 15:53
  • If there were separate, we should have descriptions for each of them to put in the tag wiki. Do have have suggestions for each?
    – Stephen Ostermiller Mod
    Nov 12, 2014 at 15:54
  • I could talk about TLS vs SSL (like now) without involving HTTPS. I could talk about HTTPS without needing TLS or SSL (like the topic starting this).
    – Martijn
    Nov 12, 2014 at 15:58
  • Descriptions can be found on the internet, plenty of explanations which might describe it better than I could
    – Martijn
    Nov 12, 2014 at 15:59
  • You can think of it like this: Gasoline(TLS) / Diesel (SSL) and car (HTTPS).
    – Martijn
    Nov 12, 2014 at 16:03
  • I have edited your answer to turn it into a proposal. Please edit anything that I didn't get right.
    – Stephen Ostermiller Mod
    Nov 12, 2014 at 16:11
  • Just a minor change, you got most if it correct :) Though SSL shouldn't be used anymore, it's still an option for HTTPS, hence the edit of the last bullit
    – Martijn
    Nov 12, 2014 at 16:15
1

For reference, here is the meta discussion where the decision was made to make HTTPS, SSL, and TLS tag synonyms. JasonBirch says:

https, ssl, tls (close enough)

I agree with his assessment that these tags are close enough to be tag synonyms. In the context of a site for webmasters, talking about HTTPS automatically implies that TLS or SSL is being used (and now that SSL is dead, TLS exclusively). If a webmaster it talking about SSL or TLS, they will necessarily being using it with the HTTPS protocol.

Since SSL is dead, I suggest making the preferred canonical tag. The tag wiki should be:

HTTPS is the secure version of the hypertext transfer protocol (HTTP). It usually uses port 443 and is powered by the TLS and SSL cryptographic protocols.

4
  • If I want to discuss something like POODLE, im not talking about https, but ssl specificly. They may be synonyms, but they're standalone as well. SSL isn't dead btw, you can still use it, a bit like md5`. You can use it, but for security is isn't that much.
    – Martijn
    Nov 13, 2014 at 8:38
  • Although people may use these technical terms incorrectly, they conflate them, so to be helpful I agree that they should be synonyms. After all, we should all be using URI instead of URL, but who does that?
    – paulmorriss
    Nov 13, 2014 at 9:16
  • @paulmorriss I finally took the time to understand the differences between URLs and URIs myself. Can I get you to fact check my understanding that I posted to this question: webmasters.stackexchange.com/a/77783
    – Stephen Ostermiller Mod
    Mar 4, 2015 at 22:53
  • Excellent work. You know more about it than me, so I can't check it for accuracy, however it is very clear.
    – paulmorriss
    Mar 5, 2015 at 12:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .