Hacker News Reader

Ofcourse CL should never downgrade to non-secure versions. SSLv3 is discouraged so CL wont try this. But 1.2 still ok.

TLS 1.2 is insecure. Prove me wrong.

So I guess we can't downgrade to it, and we should make 1.3 work without re-negotiation.

That's what they said about SSL 3 some time ago.

If a client and server both dont upgrade to secure version and still use old now-broken version, there is nothing to be done.

This thread is just now getting repeatitive.