Re:How HTTPS works
by tialaramex on Monday September 10, 2018 @01:24PM
(#17953414)
You are definitely an old curmudgeon, and I assume you are proud of that. Ironic thing about your link is that it's using Cloudflare
...So in an up-to-date browser it comes over TLS 1.3 (Cloudflare enables this by default, technically they're talking Draft 28, but this differs from the final RFC only in that drafts deliberately switch off TLS 1.3 downgrade protection since otherwise each draft would be mutually incompatible with every other system)
...So the description of how this works ends up being wrong for the site it's describing because it assumes TLS 1.{0,1,2} semantics but
...Despite the micro version change, TLS 1.3 is a significantly different protocol, both in how it begins and in details like resumption (now handled with PSKs) that this post describes for older SSL/TLS. It looks enough like TLS 1.2 that dumb middleboxes let it past.
One seldom acknowledged reason to write this sort of explanation (as a cartoon, as blog post, as a slide deck, whatever) is that the process of explaining something to other people clarifies our own understanding. When you're rehearsing "And of course the hats are invisible to bears, because..." you pause for a second -- wait, why _are_ these hats invisible to bears? Now that you come to say it, that's incredible and you realise you don't know. You go away and read the source materials - aha! Now you know why the hats are invisible and so although the purported purpose was to teach others, what you've actually done is learn for yourself.
...So in an up-to-date browser it comes over TLS 1.3 (Cloudflare enables this by default, technically they're talking Draft 28, but this differs from the final RFC only in that drafts deliberately switch off TLS 1.3 downgrade protection since otherwise each draft would be mutually incompatible with every other system)
...So the description of how this works ends up being wrong for the site it's describing because it assumes TLS 1.{0,1,2} semantics but
...Despite the micro version change, TLS 1.3 is a significantly different protocol, both in how it begins and in details like resumption (now handled with PSKs) that this post describes for older SSL/TLS. It looks enough like TLS 1.2 that dumb middleboxes let it past.
One seldom acknowledged reason to write this sort of explanation (as a cartoon, as blog post, as a slide deck, whatever) is that the process of explaining something to other people clarifies our own understanding. When you're rehearsing "And of course the hats are invisible to bears, because..." you pause for a second -- wait, why _are_ these hats invisible to bears? Now that you come to say it, that's incredible and you realise you don't know. You go away and read the source materials - aha! Now you know why the hats are invisible and so although the purported purpose was to teach others, what you've actually done is learn for yourself.
[Edited s/hosted on/using/]